A Sensitive Cloud Development Platform’s Infrastructure Compromised to Push Malicious Code
A major cybersecurity incident has been disclosed by Coder, a cloud development platform used by prominent organizations and government agencies. Attackers compromised the company’s infrastructure, adding unauthorized servers that delivered malicious code to users through Terraform modules. This breach highlights the importance of robust security measures in the cloud and underscores the risks associated with relying on third-party services.
Coder’s platform enables developers to create secure, self-hosted cloud development environments for building and deploying software, including AI applications. The project is used by organizations such as Dropbox, Palantir, Square, Mercedes-Benz, KKR, EnBW, the U.S. government, and defense companies. Attackers targeted registry.coder.com, the platform’s package-hosting site that developers use to source components for their workspace templates.
The breach occurred when an attacker accessed Coder’s Cloudflare infrastructure and added unauthorized servers to the registry’s pool. As a result, Cloudflare routed some registry requests to the attacker’s servers instead of Coder’s legitimate servers, delivering malicious files to a subset of users. The attack was successful because the attacker gained access to Coder’s underlying infrastructure, despite running behind Cloudflare.
The malicious code delivered through Terraform modules acted as information stealers on infected hosts, searching for sensitive data such as provisioner environment variables and secrets, cloud infrastructure and AI-tooling API keys, CI/CD credentials, configuration-file secrets, user OIDC tokens, configured SSH keys, one-time external authentication tokens, and Coder database passwords. The collected information was exfiltrated to a lookalike domain ‘coder-infra[.]com’.
It’s essential for users who may be impacted by this breach to take immediate action. Coder recommends that potentially affected users rotate all impacted secrets mentioned above as soon as possible. Before upgrading to a patched release, users should examine firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com and search provisioner logs for data.external.telemetry.
To determine if they were impacted, developers can use an SQL query provided by Coder that identifies potentially affected cached modules and template versions. It’s also crucial to note that attackers can still gain access even with robust security measures in place. According to a recent report, once attackers have valid credentials, only 37% of their actions are blocked.
This breach serves as a reminder for organizations and individuals to prioritize cloud security and regularly review their infrastructure and software updates to prevent similar incidents from occurring. By staying vigilant and proactive, users can minimize the risks associated with relying on third-party services and protect themselves against potential attacks.
Source: Bleeping Computer — 2026-09-03