visualstudio.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting visualstudio.com, with 3,990 total events observed over the reporting period. The majority of these events, 3,456 (86.6%), are classified as historical data breaches, while 534 (13.4%) are active infostealer logs. A substantial number of client accounts, 3,895, and 95 employee accounts were affected. The data suggests a high volume of credential compromise, with malware families like LummaC2, Redline, and Rhadamanthys being prevalent in infostealer logs. The primary source of data breaches appears to be combolist sources, indicating credential stuffing or reuse of compromised credentials. The timeline shows a notable increase in client-related events in March and April 2026, coinciding with a rise in employee-related events. The affected services are primarily within the visualstudio.com domain, including specific subdomains like gdidelot.visualstudio.com, suggesting potential compromise of development or collaboration platforms. The high volume of data breaches and active infostealer logs, coupled with the impact on both employee and client accounts, elevates the risk associated with this exposure. The prevalence of common infostealer malware families points to a broad attack vector. Prioritization should focus on immediate incident response to contain any ongoing compromise, thorough investigation of the data breaches to understand the scope of client and employee data exfiltration, and remediation efforts to secure affected accounts and systems. This includes credential reset campaigns for affected users, enhanced monitoring for suspicious activity on visualstudio.com resources, and a review of security configurations for the identified targeted services.