Data Breaches Expose GitHub Repos and Microsoft Defender Vulnerabilities This Week

This week’s breach story wasn’t defined by a single mega-leak headline—it was defined by the plumbing that makes breaches possible. Between May 18 and May 25, 2026, the most consequential developments clustered around three realities: attackers are increasingly entering through trusted developer tooling, defenders are still racing to patch actively exploited endpoints, and credential theft is evolving to bypass the controls many organizations consider “done,” like MFA.

The clearest “data breach” signal came from GitHub’s disclosure that attackers accessed 3,800 internal repositories after a malicious version of the Nx Console VS Code extension was used as an entry point—an incident GitHub linked to the TanStack npm supply-chain attack and attributed to the TeamPCP group. The reported goal was straightforward: steal credentials and secrets spanning ecosystems like npm, AWS, and GitHub itself. [2] That’s not just a GitHub problem; it’s a blueprint for how modern breaches propagate across CI/CD, cloud, and code.

At the same time, Microsoft patched two actively exploited Microsoft Defender zero-days—one enabling SYSTEM privilege escalation and another capable of pushing devices into denial-of-service states. [1] While not a breach by itself, active exploitation of endpoint security components is a direct accelerant for breach chains.

Finally, the FBI warned about Kali365, a phishing-as-a-service platform targeting Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass MFA. [4] Put together, the week’s theme is uncomfortable but clear: the breach perimeter is now your extensions, your tokens, and your patch cadence.

Supply-chain compromise meets internal repo exposure at GitHub

GitHub disclosed that hackers accessed 3,800 internal repositories, tying the intrusion to a malicious version of the Nx Console VS Code extension that was compromised during the TanStack npm supply-chain attack. [2] The reported mechanics matter: a developer tool—something designed to increase productivity—became the conduit for credential and secret theft. According to the disclosure, the attackers used the extension to steal credentials and secrets from multiple platforms, including npm, AWS, and GitHub. [2]

This is a breach pattern that’s hard to “firewall away.” Developer environments are inherently privileged: they touch source code, build pipelines, package registries, and cloud credentials. When a trusted extension turns hostile, it can harvest the exact artifacts that make lateral movement cheap—tokens, keys, and repository secrets—without needing to exploit a server-side vulnerability first. GitHub said it secured the compromised device and is investigating the incident. [2]

The key point for engineering leaders is that the blast radius of a supply-chain compromise is not limited to the package or extension itself. Once secrets are exposed, the attacker’s next steps can be entirely “legitimate” API calls: cloning repos, accessing internal tooling, or pivoting into cloud accounts. GitHub’s report that the activity involved credential and secret theft across ecosystems underscores how quickly a single compromised developer endpoint can become a multi-platform breach. [2]

In other words, this wasn’t just about a poisoned dependency—it was about how modern organizations concentrate trust in developer tooling, and how attackers are increasingly monetizing that trust.

Actively exploited Defender zero-days: breach accelerants hiding in plain sight

Microsoft released patches for two zero-day vulnerabilities in Microsoft Defender—CVE-2026-41091 and CVE-2026-45498—and warned they were being actively exploited. [1] The first vulnerability allows attackers to gain SYSTEM privileges, while the second can trigger denial-of-service states on unpatched Windows devices. [1] Even without additional details, the implications are direct: privilege escalation to SYSTEM is a classic step in turning initial access into full control of a machine, and denial-of-service can be used to disrupt operations or degrade defenses during an intrusion.

For breach prevention, the uncomfortable lesson is that “security software” is not automatically “security.” When endpoint protection components themselves contain exploitable flaws, attackers can weaponize the very layer organizations rely on for detection and containment. Microsoft’s guidance was to ensure systems are updated to the latest versions to mitigate risk. [1]

From a breach-chain perspective, a SYSTEM-level foothold can enable credential dumping, tampering with security controls, and persistence—common prerequisites for data access and exfiltration. While the report focuses on the vulnerabilities and patching, the broader takeaway is operational: patch latency becomes a measurable breach risk when exploitation is already in the wild. [1]

This week’s Defender news also reinforces a practical reality for incident responders: when investigating suspicious activity on Windows endpoints, it’s not enough to ask “Is Defender running?” You also need to ask “Was Defender patched?” because an unpatched security component can be part of the attacker’s toolkit rather than the defender’s shield. [1]

Token theft that bypasses MFA: Kali365 and the Microsoft 365 account takeover path

The FBI warned about Kali365, a phishing-as-a-service platform targeting Microsoft 365 accounts. [4] The notable technique described is the exploitation of OAuth device code authentication to steal session tokens, effectively bypassing multi-factor authentication (MFA). [4] That detail is crucial: many organizations treat MFA rollout as the finish line, but token theft attacks shift the contest from “can you enter the code?” to “can you steal the already-authenticated session?”

In practical terms, session tokens are the keys to the kingdom for cloud productivity suites. If an attacker can obtain a valid token, they may not need to defeat MFA at all—because the token represents an authenticated state. The FBI’s warning frames Kali365 as a service, which also matters: phishing capability is being packaged and scaled, lowering the barrier for attackers to run sophisticated account takeover campaigns. [4]

For breach risk, Microsoft 365 account compromise is often the gateway to sensitive data exposure: email, files, collaboration spaces, and the internal conversations that reveal how systems are administered. The FBI urged organizations to implement additional security measures to protect against these attacks. [4] While the warning doesn’t enumerate those measures in the provided summary, the strategic message is clear: identity security must account for token-based abuse, not just password and MFA prompts.

This week’s identity-focused warning pairs uncomfortably well with the supply-chain story: stolen secrets from developer tooling and stolen session tokens from phishing both converge on the same outcome—unauthorized access that looks legitimate until it’s too late. [2][4]

Web app exploitation at scale: Ghost CMS SQL injection and ClickFix flows

BleepingComputer reported that a critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980) is being exploited in a large-scale campaign. [5] The exploitation is used to inject malicious JavaScript code, leading to ClickFix attack flows. [5] While the report centers on exploitation rather than a confirmed data theft event, large-scale injection campaigns are a well-worn on-ramp to breaches: once an attacker can inject code, they can manipulate user sessions, redirect traffic, or deliver follow-on payloads.

The operational guidance was direct: administrators should update Ghost CMS installations to the latest version to prevent exploitation. [5] This is the recurring theme of the week—patching isn’t a best practice in the abstract; it’s a response to active campaigns.

The “large-scale” descriptor is also a reminder that attackers industrialize what works. SQL injection remains one of the most durable web exploitation techniques because it targets a common failure mode: insufficient input sanitization and query handling. When paired with JavaScript injection, the attacker can shift from server-side compromise to client-side manipulation, potentially impacting site visitors as well as the organization operating the CMS. [5]

For organizations that run content platforms, the Ghost CMS story is a prompt to treat CMS infrastructure as production-critical, not “marketing-owned.” When exploitation is active and widespread, the window between vulnerability disclosure and compromise can be short—especially for internet-facing systems. [5]

Analysis & Implications: the breach perimeter is now “trusted” by default

Across these stories, the connective tissue is trust—and how attackers are exploiting it.

First, the GitHub incident shows how trust in developer tooling can translate into direct access to high-value internal assets. A malicious VS Code extension is not just a nuisance; it’s a credential and secret collection mechanism embedded in the workflows that engineers run all day. GitHub’s disclosure that attackers accessed 3,800 internal repositories after using the compromised Nx Console extension—and that the activity involved stealing secrets across npm, AWS, and GitHub—illustrates how quickly a supply-chain compromise can become a multi-environment breach. [2]

Second, the Microsoft Defender zero-days highlight a different kind of trust: trust in the defensive layer. When vulnerabilities in Defender are actively exploited, patch management becomes inseparable from breach prevention. A SYSTEM privilege escalation flaw is a classic breach accelerant, and a denial-of-service condition can disrupt normal operations on unpatched devices. Microsoft’s message—update to the latest versions—reads like routine hygiene, but the “actively exploited” context makes it urgent. [1]

Third, Kali365 underscores the shift from credential theft to session theft. By exploiting OAuth device code authentication to steal session tokens and bypass MFA, attackers are targeting the authentication artifacts that modern cloud services rely on. [4] This is a strategic evolution: rather than fighting MFA head-on, attackers route around it.

Finally, Ghost CMS exploitation demonstrates that internet-facing applications remain a high-throughput compromise surface. A critical SQL injection flaw being exploited at scale to inject malicious JavaScript and drive ClickFix flows is a reminder that web exploitation campaigns can be both broad and automated. [5]

Put together, the week suggests a practical prioritization for security teams: reduce secret exposure in developer environments, shorten patch cycles for actively exploited vulnerabilities (including in security products), and treat token theft as a first-class identity threat. The breach perimeter is no longer just “the network edge”—it’s the extension marketplace, the endpoint security stack, and the session token sitting in a browser context. [1][2][4][5]

Conclusion: breaches are becoming workflow-native

This week’s breach-adjacent headlines point to a sobering direction: attackers are embedding themselves into normal work patterns. A compromised developer extension can quietly harvest secrets that unlock repositories and cloud environments. [2] A phishing service can bypass MFA by stealing session tokens rather than passwords. [4] And actively exploited vulnerabilities—whether in a CMS or even in endpoint protection—compress the time defenders have to react. [1][5]

The common defensive instinct is to buy another tool. The more durable response is to harden the workflows that tools sit inside: how developers install and trust extensions, how secrets are stored and rotated, how quickly endpoints are patched when exploitation is confirmed, and how identity systems detect and constrain token abuse. [1][2][4]

If there’s a single takeaway for May 18–25, it’s that “data breach prevention” is increasingly about controlling the invisible glue—extensions, tokens, and updates—that holds modern engineering organizations together. When that glue is compromised, the breach doesn’t arrive with a bang; it arrives as a normal login, a normal clone, a normal API call—until the data is already gone. [2][4]

References

[1] Microsoft warns of new Defender zero-days exploited in attacks — BleepingComputer, May 21, 2026, https://www.bleepingcomputer.com/news/security/microsoft-warns-of-new-defender-zero-days-exploited-in-attacks/?utm_source=openai
[2] GitHub links repo breach to TanStack npm supply-chain attack — BleepingComputer, May 21, 2026, https://www.bleepingcomputer.com/news/security/github-links-repo-breach-to-tanstack-npm-supply-chain-attack/?utm_source=openai
[4] FBI warns of Kali365 phishing service targeting Microsoft 365 accounts — BleepingComputer, May 25, 2026, https://www.bleepingcomputer.com/?utm_source=openai
[5] Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign — BleepingComputer, May 24, 2026, https://www.bleepingcomputer.com/?utm_source=openai