--- title: What happened to Code Spaces could happen to you. On... description: Reflecting on the Code Spaces incident, where an attacker gained control panel access and deleted a company's data and EC2 instances, destroying the business... canonical: https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What happened to Code Spaces could happen to you. On Amazon, Azure and any host out there. | daily.dev og:description: Reflecting on the Code Spaces incident, where an attacker gained control panel access and deleted a company's data and EC2 instances, destroying the business... og:url: https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o og:image: https://api.daily.dev/og/posts/eJwpJ1n9O.png og:image:alt: What happened to Code Spaces could happen to you. On Amazon, Azure and any host out there. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What happened to Code Spaces could happen to you. On Amazon, Azure and any host out there. **[Maarten Balliauw](https://daily.dev/sources/maartenballiauw)** · 6 min read · 0 upvotes · 0 comments ## Summary Reflecting on the Code Spaces incident, where an attacker gained control panel access and deleted a company's data and EC2 instances, destroying the business within hours, this piece warns that the same risk applies to any cloud host, including Microsoft Azure. It walks through attack vectors specific to Azure: compromised Microsoft Accounts tied to many subscriptions, unprotected management certificates, malicious NuGet packages that run PowerShell on install, and misuse of PowerShell/cross-platform tools or the Visual Studio DTE object to silently provision or delete resources. Recommended mitigations include enabling two-factor authentication, partitioning accounts per subscription, avoiding blanket admin access, managing certificate lifetimes, invalidating credentials after use, not distributing publish settings files, and automating via build servers rather than developer machines. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened to Code Spaces that caused the company to shut down? An attacker gained access to the Code Spaces Amazon EC2 control panel, demanded a ransom, and after failed attempts to regain control, began deleting data and EC2 instances. The destruction happened within about 12 hours and left the company unable to continue operating or refund customers, ending the business entirely. _Cloud account takeovers like this show why teams track security practices for AWS and Azure on daily.dev._ ### How could a malicious NuGet package compromise my Azure subscription? NuGet packages can run PowerShell code on install in Visual Studio, so a maliciously named package (for example a typo-squatted 'jQeury') could bundle legitimate-looking content while secretly invoking Azure PowerShell cmdlets or cross-platform tools to create storage accounts, mirror illegal content, or delete virtual machines using the currently active subscription credentials. _Developers wary of supply-chain risks in package managers follow security writeups like this on daily.dev._ ### How can I secure my Microsoft Account that manages multiple Azure subscriptions? Enable two-factor authentication on the Microsoft Account, use a separate account with a unique complex password for each subscription rather than one account tied to many, and avoid making every account an administrator on every subscription since that broadens the attack surface even though it is more convenient. _Teams managing multiple Azure subscriptions compare account-hardening approaches on daily.dev._ ## Similar posts on daily.dev - [Microsoft pulled 73 GitHub repos after malware attack — but still won’t say who’s compromised](https://daily.dev/posts/microsoft-pulled-73-github-repos-after-malware-attack-but-still-won-t-say-who-s-compromised-klwp4mgla) · The New Stack · 0 upvotes · 0 comments - [Microsoft Self-Service Password Reset abused in Azure data theft attacks](https://daily.dev/posts/microsoft-self-service-password-reset-abused-in-azure-data-theft-attacks-wzksyvp0l) · BleepingComputer · 0 upvotes · 0 comments - [Amazon Q VS Extension Flaw Leads to Cloud Credential Theft](https://daily.dev/posts/amazon-q-vs-extension-flaw-leads-to-cloud-credential-theft-tygs9gdjh) · Dark Reading · 0 upvotes · 0 comments - [Hybrid clouds have two attack surfaces – so watch both](https://daily.dev/posts/hybrid-clouds-have-two-attack-surfaces-so-watch-both-rniu9k8jd) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#azure](https://daily.dev/tags/azure), [#secrets-management](https://daily.dev/tags/secrets-management), [#nuget](https://daily.dev/tags/nuget) [View this post on daily.dev](https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What happened to Code Spaces could happen to you. On Amazon, Azure and any host out there.","url":"https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o"},"datePublished":"2026-10-04T13:04:11.711Z","dateModified":"2026-10-04T13:05:26.709Z","description":"Reflecting on the Code Spaces incident, where an attacker gained control panel access and deleted a company's data and EC2 instances, destroying the business...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e94b71ce1751167d10b8317b5331140?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5e94b71ce1751167d10b8317b5331140?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Maarten Balliauw","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Maarten Balliauw","logo":"https://media.daily.dev/image/upload/s--rOTg3VYO--/f_auto,q_auto/v1791119043/logos/maartenballiauw?_a=BAMAMicg0","url":"https://daily.dev/sources/maartenballiauw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,azure,secrets-management,nuget","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Maarten Balliauw","item":"https://daily.dev/sources/maartenballiauw"},{"@type":"ListItem","position":3,"name":"What happened to Code Spaces could happen to you. On Amazon, Azure and any host out there."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-happened-to-code-spaces-could-happen-to-you-on-amazon-azure-and-any-host-out-there--ejwpj1n9o#faq","mainEntity":[{"@type":"Question","name":"What happened to Code Spaces that caused the company to shut down?","acceptedAnswer":{"@type":"Answer","text":"An attacker gained access to the Code Spaces Amazon EC2 control panel, demanded a ransom, and after failed attempts to regain control, began deleting data and EC2 instances. The destruction happened within about 12 hours and left the company unable to continue operating or refund customers, ending the business entirely. Cloud account takeovers like this show why teams track security practices for AWS and Azure on daily.dev."}},{"@type":"Question","name":"How could a malicious NuGet package compromise my Azure subscription?","acceptedAnswer":{"@type":"Answer","text":"NuGet packages can run PowerShell code on install in Visual Studio, so a maliciously named package (for example a typo-squatted 'jQeury') could bundle legitimate-looking content while secretly invoking Azure PowerShell cmdlets or cross-platform tools to create storage accounts, mirror illegal content, or delete virtual machines using the currently active subscription credentials. Developers wary of supply-chain risks in package managers follow security writeups like this on daily.dev."}},{"@type":"Question","name":"How can I secure my Microsoft Account that manages multiple Azure subscriptions?","acceptedAnswer":{"@type":"Answer","text":"Enable two-factor authentication on the Microsoft Account, use a separate account with a unique complex password for each subscription rather than one account tied to many, and avoid making every account an administrator on every subscription since that broadens the attack surface even though it is more convenient. Teams managing multiple Azure subscriptions compare account-hardening approaches on daily.dev."}}]} ```