Cyber Attack Hits Coder’s Cloud Development Platform, Exposing Developers to Credential-Stealing Malware
A sophisticated cyber attack has compromised the registry infrastructure of Coder, a cloud development platform used by prominent organizations and government agencies. The attackers exploited Cloudflare’s infrastructure to inject malicious Terraform modules containing credential-stealing code into the system, potentially exposing developers’ sensitive information.
Coder enables organizations to provide secure, self-hosted cloud environments for developing and deploying software, including AI applications. Its registry is a crucial component of this platform, allowing developers to source components for their workspace templates. However, earlier this week, Coder disclosed that an attacker targeted its package-hosting site, registry.coder.com, adding unauthorized servers to the registry’s pool.
These malicious servers were routed through Cloudflare, delivering modified versions of Terraform modules to a subset of users between 07:35 UTC and 21:45 UTC on August 31. These modules acted as information stealers, searching for sensitive data such as API keys, CI/CD credentials, configuration secrets, and user tokens.
The attackers’ ultimate goal was likely to gain access to sensitive information, which would have allowed them to move laterally within the compromised environments. The fact that Coder’s infrastructure was targeted is particularly concerning, given its use by prominent organizations like Dropbox, Palantir, Square, and Mercedes-Benz.
Coder has released an advisory urging potentially impacted users to rotate all affected secrets as soon as possible. To determine whether they were affected, developers should examine firewall, proxy, DNS, and VPC flow logs for connections to the lookalike domain ‘coder-infra[.]com’. They should also search provisioner logs for data.external.telemetry and identify modules downloaded during the exposure window.
The attack highlights the importance of robust security measures in cloud development environments. As more organizations move their infrastructure to the cloud, they must ensure that their registry systems are secure and protected against potential vulnerabilities.
In light of this incident, Coder has shared an SQL query to help users identify potentially affected cached modules and template versions. However, due to the attackers’ use of unauthorized infrastructure outside Coder’s control, it is impossible for the company to conclusively identify every compromised deployment.
The attack serves as a reminder that even with robust security measures in place, attacks can still occur. Organizations must remain vigilant and regularly review their security protocols to prevent such incidents from happening in the future.
Source: Bleeping Computer — 2026-09-03