Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
Thousands of VMs created by CoinMiner and / or Multiverze
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 22%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKP%3C/text%3E%3C/svg%3E)
Kiran Pande
0
Reputation points
Microsoft must absorb/not charge for any usage here.
Azure Virtual Machines
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 36%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESH%3C/text%3E%3C/svg%3E)
Shree Hima Bindu Maganti 7,590 Reputation points Microsoft External Staff Moderator2026-03-15T17:24:26.61+00:00 Hi @Kiran Pande
The subscription abused to spin up thousands of CoinMiner/Multiverze VMs. Azure billing is usage-based, so you’ll need to:- Immediately deallocate/delete the malicious VMs to stop the costs.
- Audit your Activity Logs and Azure AD sign-ins to identify which account, service principal or managed identity was compromised.
- Revoke those credentials and rotate any affected keys/passwords.
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-marketplace-azure-items?view=azs-2601
https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-linux?view=azs-2601&tabs=az
Please share the requested details through a private message for further investigation.
Sign in to comment
Sign in to answer