#microsoft

3 analyses tagged microsoft, sorted newest first.

critical 5 sources
Miasma DurableTask GitHub Repository Compromise
On June 5, 2026, the official Azure/durabletask GitHub repository was compromised. Threat actors pushed a backdated commit ('Switched DataConverter to OrchestrationContext [skip ci]') that added a malicious tasks.json and configuration files targeting AI coding tools to execute credential-stealing payloads. Later follow-up reporting showed the broader Miasma/Hades campaign continued spreading across npm and PyPI through open-time and import-time triggers.

#github #repository-compromise #supply-chain #credential-theft #microsoft #azure #miasma #hades #teampcp

2026-06-05
high 3 sources
Windows cldflt.sys Zero-Day: MiniPlasma Kernel LPE
MiniPlasma is a public Windows cldflt.sys Cloud Filter driver LPE proof of concept that BleepingComputer tested on fully patched Windows 11 Pro with May 2026 updates. The article now replaces generic secondary sourcing with exact reporting and narrows the claim to local SYSTEM escalation.

#microsoft #windows #zero-day #privilege-escalation #kernel-exploit

2026-05-26
critical 3 sources
Microsoft DurableTask Python SDK PyPI Hijacking
On May 19, 2026, the official Microsoft durabletask Python SDK was compromised on PyPI. Threat actors used hijacked publishing credentials to directly upload malicious versions containing a cloud credential-harvesting payload.

#pypi #package-compromise #supply-chain #credential-theft #microsoft #teampcp

2026-05-19