English(EN) For the 2nd time in weeks, Microsoft packages laced with credential stealer

微软软件包两次被植入窃取凭证的AI恶意软件

作者 PulseAugur 编辑部 · [2 个来源] · 2026-06-08 18:34

微软官方开源软件包在数周内第二次遭到入侵，73个软件包被注入了旨在窃取凭证的恶意代码。当开发人员使用AI编码代理打开这些软件包时，这些代码就会被激活，可能通过窃取AWS、Azure和GCP等云提供商的令牌，以及密码管理器和开发人员工具的凭证来危及系统。此次攻击与威胁组织TeamPCP有关，使用了名为Miasma的恶意软件，并通过利用合法的微软OIDC令牌绕过了存储库构建管道。 AI

影响受损的AI开发工具和软件包对AI项目和基础设施的安全性构成了重大风险。

排序理由此集群描述了一起涉及受损软件包的安全事件，而不是新的AI模型发布或核心AI研究。

在 Ars Technica — AI 阅读 →

AI 生成摘要 · Google Gemini · 来自 2 个来源。我们如何撰写摘要 →

报道来源 [2]

Ars Technica — AI TIER_1 English(EN) · Dan Goodin · 2026-06-08 18:34

For the 2nd time in weeks, Microsoft packages laced with credential stealer

73 packages run self-replicating stealer as soon as they're opened by an AI agent.
Mastodon — fosstodon.org TIER_1 English(EN) · [email protected] · 2026-06-08 18:55

For the second time in weeks, Microsoft packages have been found laced with credential-stealing code designed to activate when developers open them in AI coding

For the second time in weeks, Microsoft packages have been found laced with credential-stealing code designed to activate when developers open them in AI coding agents. 73 packages were blocked on GitHub, executing a payload that steals credentials from AWS, Azure, GCP, Kubernete…

链接 arstechnica.com/…/for-the-2nd-time-in-wee… arstechnica.com/…/2026

报道来源 [2]

For the 2nd time in weeks, Microsoft packages laced with credential stealer

For the second time in weeks, Microsoft packages have been found laced with credential-stealing code designed to activate when developers open them in AI coding

相关实体

相关话题