Loading story…
Microsoft automatically suspended developer accounts used by several high-profile projects — including WireGuard, VeraCrypt, MemTest86, and Windscribe — after they did not complete a mandatory Windows Hardware Program verification process, cutting off their ability to sign drivers, submit releases, and publish Windows builds. Developers said the suspensions arrived without clear warning or explanation and left them unable to reach effective human support, disrupting normal release processes for software relied on by security- and privacy-conscious users.
WireGuard creator Jason Donenfeld said the lockout prevented him from shipping updates to Windows users and warned that a future critical flaw could leave users exposed until access was restored, although he said no such vulnerability currently exists. Microsoft said the suspensions were tied to account verification requirements introduced in 2024 and later acknowledged that suspended partners could no longer submit releases; after public reporting, company executives said the issue would be addressed, and affected developers including VeraCrypt and Windscribe reported that Microsoft had begun outreach to help restore access.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Microsoft introduced a temporary fast-track process to restore access for recently suspended Windows Hardware Program accounts after complaints from affected developers. Under the process, developers must open a support case with a business justification, and Microsoft may reinstate access while remaining verification issues are resolved.
Following media attention, Microsoft Vice President Scott Hanselman said the problem would be addressed. Jason Donenfeld said he had finally made contact with Microsoft, while VeraCrypt and Windscribe also confirmed outreach to help restore access.
After the issue drew attention, Microsoft said the suspensions were automated and linked to the mandatory account verification process. The company also clarified that suspended accounts could no longer submit releases.
Reporting showed that VeraCrypt, Windscribe, and MemTest86 were also affected by Microsoft account suspensions, temporarily blocking their ability to publish Windows builds and security updates. Developers said they received little explanation and struggled to reach Microsoft support.
WireGuard creator Jason Donenfeld disclosed that Microsoft had locked him out of the developer portion of his account, stopping him from signing drivers and shipping WireGuard updates to Windows users. He said he had received no notification before the suspension and warned this could delay urgent security fixes if one were needed.
Accounts that had not completed the required Windows Hardware Program verification since April 2024 were automatically suspended, preventing some developers from signing drivers and submitting Windows releases. Affected projects included WireGuard, VeraCrypt, MemTest86, and Windscribe.
Microsoft started enforcing mandatory identity verification for Windows Hardware Program partners on 2025-10-16, giving accounts 30 days to comply before suspension. This enforcement step set up the later automatic lockouts of unverified developer accounts.
Microsoft announced a mandatory verification process for Windows Hardware Program partner accounts. The company said accounts that did not complete verification would be automatically suspended after 30 days.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourceghacks.net
Open sourcezdnet.fr
Open sourcecybersecuritynews.com
Open sourceinfoworld.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent series of Windows updates has caused significant disruptions to enterprise environments, impacting both messaging services and remote access capabilities. The Windows 10 update KB5071546 has been reported to break the Microsoft Message Queuing (MSMQ) service due to insufficient permissions, potentially affecting business-critical messaging workflows. This issue may hinder the ability of enterprise applications to communicate reliably, posing operational risks for organizations relying on MSMQ for distributed systems or alerting mechanisms. Separately, Microsoft’s October 2025 non-security update KB5067036 for Windows 11 has disrupted virtual private server (VPS) access for users of the Windows Subsystem for Linux (WSL), particularly those dependent on third-party VPNs such as Cisco Secure Client and OpenVPN. Users have experienced “No route to host” errors in WSL’s mirrored networking mode, blocking access to corporate resources and impeding remote work and security operations. Microsoft has acknowledged the VPN issue and is investigating, with temporary workarounds available but no permanent fix yet. These incidents highlight the need for rigorous testing of Windows updates in enterprise environments, especially where hybrid Linux-Windows workflows are critical for cybersecurity operations.
Jun 29, 2026
GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected **Miasma** worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to `Azure/durabletask`, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including **Claude Code**, **Gemini CLI**, and **Cursor**. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired. The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s `durabletask` PyPI package and to a newer campaign tracked by StepSecurity as **Hades**, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.
Jun 29, 2026
Microsoft’s January 2026 Windows security updates introduced regressions that disrupted enterprise endpoints, including **Remote Desktop authentication failures** affecting access to *Azure Virtual Desktop* and *Windows 365*. After installing `KB5074109` on specific Windows client builds (noted as Builds **26200.7623** and **26100.7623**), users reported repeated credential prompt/sign-in failures in the **Windows App**, preventing successful remote session establishment; Microsoft acknowledged the issue and issued an **out-of-band** update intended to restore normal Remote Desktop connectivity. Separately, Microsoft confirmed another January patch-related issue on Windows 11 23H2 where some systems with **Secure Launch** enabled may **fail to shut down, restart, or hibernate**, leaving devices running and potentially draining batteries. As a workaround, Microsoft advised forcing shutdown via the command: ```cmd shutdown /s /t 0 ``` Microsoft indicated a permanent fix would be delivered in a future update, but did not provide scope/impact metrics for affected devices.
Jun 29, 2026