Microsoft Confirms Breach by Lapsus$

The advisory reports that the Lapsus$ threat group compromised Microsoft’s Azure DevOps server and leaked around 37GB of source code. The group obtains credentials and session tokens through Redline malware, criminal forums, or payments to employees. It also uses repeated MFA notifications and SIM swapping to gain access. After entry, the attackers exploit unpatched vulnerabilities or search repositories and collaboration platforms for exposed credentials to gain higher privileges, then exfiltrate data over NordVPN.