Hackers Compromise Coder Infrastructure to Distribute Malicious Terraform Modules

SAN FRANCISCO — Unidentified malicious actors compromised the cloud infrastructure of software developer Coder on Wednesday, injecting unauthorized registry servers that distributed malicious Terraform modules containing credential-stealing code. The attack, detected on September 3, 2026, targeted the company's Cloudflare environment, allowing attackers to intercept and alter software configurations used by developers globally.

The intrusion involved the insertion of rogue registry servers into Coder's network. These compromised servers began distributing Terraform modules—software components used to automate infrastructure deployment—that were laced with code designed to harvest sensitive credentials from users who downloaded them. The malicious payload was embedded within the legitimate-looking software packages, bypassing standard security checks as the modules appeared to originate from trusted sources.

Coder confirmed the breach after detecting anomalies in its traffic patterns and registry behavior. The company immediately initiated a containment protocol, shutting down the affected registry servers and revoking access tokens associated with the compromised infrastructure. Security teams are currently working to identify the full scope of the infection and determine which users may have downloaded the tainted modules.

The attack highlights growing vulnerabilities in the supply chain for infrastructure-as-code tools. Terraform is widely used by enterprises to manage cloud resources, making it a high-value target for threat actors seeking to gain persistent access to critical systems. By compromising the registry where these modules are hosted, attackers can infect thousands of downstream users with minimal effort.

No specific group has claimed responsibility for the incident, and the motive behind the attack remains unclear. While some analysts speculate that the operation may be linked to state-sponsored espionage or organized cybercrime rings seeking financial gain, no definitive evidence supports these theories at this time. The attackers' identity and ultimate objectives have not been disclosed.

Coder stated it is cooperating with cybersecurity firms and law enforcement agencies to investigate the breach. The company has advised all users who interacted with its Terraform registry between the estimated start of the intrusion and the time of detection to rotate their credentials immediately. A full forensic analysis is underway to determine if any additional systems were affected or if data was exfiltrated beyond the credential-stealing mechanism.

The incident underscores the fragility of modern software supply chains, where a single point of compromise can ripple through global networks. As organizations increasingly rely on automated infrastructure tools, the risk of such attacks continues to rise. Questions remain regarding how long the attackers maintained access before detection and whether other registries or platforms may have been similarly targeted.

Further updates are expected as investigators piece together the timeline of the breach and assess the potential impact on affected users worldwide.