LAPSUS$ Stole Source Code After Socially Engineering Access at Major Firms

Microsoft confirmed that LAPSUS$ compromised a single employee account and used that foothold to gain limited access to internal source-code repositories, leading to the leak of code tied to projects including Bing, Cortana, and Bing Maps. The company said no customer code or customer data was affected and that the compromised account was remediated, but the incident reinforced the group’s ability to turn relatively simple access methods into high-impact breaches at globally recognized targets.

Reporting across multiple investigations describes LAPSUS$ as a fast-moving data extortion actor that relied heavily on social engineering, SIM swapping, credential theft, session-token abuse, MFA fatigue, help-desk manipulation, and purchases or solicitation of insider access rather than advanced malware or ransomware deployment. The group publicly used Telegram to leak stolen data, pressure victims, and recruit access brokers, and it was linked to intrusions affecting organizations including NVIDIA, Okta, Samsung, Microsoft, Vodafone Portugal, Ubisoft, LG, and Brazil’s Ministry of Health; researchers said its behavior mixed financial motives with disruption, publicity, and notoriety, suggesting the threat could persist through remaining members or copycat actors even after arrests.