App service got attacked

Question

App service got attacked

Lekhika Goswami 40

User's image

My users are getting this and got redirected to this url: https://bsc-testnet-rpc.publicnode.com/

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Praneeth Maddali 12,670 Microsoft External Staff Moderator

Hi @Lekhika Goswami
Possibilities as discussed.

Malicious JavaScript injection into the application causing user redirection.

Compromised application code or deployment pipeline resulting in unauthorized changes.
Third-party script/CDN compromise injecting malicious content into the website.
Leaked deployment credentials (Publish Profile, FTP, GitHub, Azure DevOps, etc.) used to modify the application.
Front-end infrastructure compromise (Front Door, CDN, Cloudflare, Application Gateway) serving malicious redirects.
Region-specific attack logic, where only certain users or geographies are redirected.

Directed the customer to support queue.

Greg Watts 0 Reputation points

2026-07-31T21:41:40.48+00:00

Hi,

I would like to also report that I've been affected by this specific attack as well.
I've managed to mitigate it with a proper CSP policy.

But in the way of some diagnostics, I believe that the whole app container was compromised. There were numerous folders and executables that I found through Kudu, and after multiple deploys and rotation of publish credentials, the attack still manages to self-heal after the app restarts.

Cheers.

Answer 2

Saritha Bandaru 665 Microsoft External Staff Moderator

Hello @Lekhika Goswami

From the case details, I understand that you are facing an issue where users of your Azure App Service are being redirected to https://bsc-testnet-rpc.publicnode.com/ — a Binance Smart Chain testnet RPC endpoint. This behavior indicates that your web app is serving injected/malicious content, which typically means the application was compromised through an exploited vulnerability (for example, an outdated package or framework) or a leaked deployment credential.

Currently i am looking into your issue. In the meantime, please share if you have any additional information.

Did you make any deployment, code change, or dependency update just before users started getting redirected?
When you open Deployment Center, do you see any deployment you don't recognize?
Are all users redirected, or only some — specific pages, regions, or devices/browsers?
Does the redirect happen for you too in a private/incognito window?
Have you enabled and reviewed the HTTP/Web Server logs? Can you identify the first time the redirect or an unfamiliar file appeared?
What does this app have access to — Key Vault, storage, databases, managed identity, connection strings?
Is Microsoft Defender for App Service enabled? Any alerts in Defender for Cloud for this app?

Thanks

Lekhika Goswami 40 Reputation points

2026-07-20T05:09:33.48+00:00
Did you make any deployment, code change, or dependency update just before users started getting redirected?

No the last code deployment was on 17th

When you open Deployment Center, do you see any deployment you don't recognize?

No

Are all users redirected, or only some — specific pages, regions, or devices/browsers?

All the users majorly from australia region

Does the redirect happen for you too in a private/incognito window?

No not for me , but soon i stopped the app service to prevent anything else

Have you enabled and reviewed the HTTP/Web Server logs? Can you identify the first time the redirect or an unfamiliar file appeared?

I have downloaded logs but don't see anything suspicious there, the first time it happend was today around 7-8 AM morning

What does this app have access to — Key Vault, storage, databases, managed identity, connection strings?
Yes it has access to key vaults, managed identity, db, everything is setup in env variables

Is Microsoft Defender for App Service enabled? Any alerts in Defender for Cloud for this app?

no
Saritha Bandaru 665 Reputation points Microsoft External Staff Moderator

2026-07-20T05:39:40.9633333+00:00

Hello @Lekhika Goswami,

Thanks again for the details so far — you've done the right thing by stopping the app. To investigate this hands-on from our side, I'd like to move this to a formal Azure support case, since a public Q&A thread doesn't allow us to access your environment.

For this, I have shared a consent link to you over Private message. Kindly check your private messages.

Thanks
Lekhika Goswami 40 Reputation points

2026-07-20T06:10:28.7466667+00:00

I have checked the link but I am not able to open the support ticket and I don't see the form.