Earlier, it was observed that the developer accounts for the open-source projects VeraCrypt and WireGuard were summarily suspended by Microsoft. This administrative sanction rendered the developers unable to sign their drivers—a critical failure, as the Windows NT kernel refuses to execute any driver lacking a verified, trusted signature.
While these accounts were eventually reinstated through the intervention of Microsoft’s Vice President of Developer Relations, the underlying cause for the suspensions remains shrouded in mystery. However, it is increasingly evident that the scope of this disruption is far more expansive than initially presumed.
The developers behind the OSR Driver loader and the open-source virtualization suite UTM have also fallen victim to these account purges. Although OSR’s access has been restored following executive intervention, the UTM developer remains disenfranchised. Most disconcerting is the nature of UTM’s loss: unlike others who received suspension notices, the UTM account appears to have been entirely expunged from the system. Upon attempting to authenticate, the developer is met with the literal assertion that the account does not exist—a baffling development that has left the creator utterly bewildered.
The authentication prompt for the UTM developer simply states: “The email or username you entered does not exist. Please check you have typed your email or username correctly.”
In the absence of a valid developer account, the requisite signing of drivers is impossible. As UTM is a virtualization platform reliant on kernel-level drivers, the project has reached a stalemate, unable to deploy any subsequent updates. The UTM developer lamented that after navigating the arduous process of obtaining an EV enterprise-level signature and completing exhaustive identity verifications to release a GPU driver in 2025, their account has vanished without a single notification from Microsoft.
Given the mounting public scrutiny surrounding these systematic bans, it is anticipated that the UTM predicament will also require high-level intervention. Microsoft, however, has maintained a stoic silence regarding the impetus of these failures, leaving many to speculate that the number of affected developers is substantial. Such a significant oversight likely points to an internal restructuring of workflows at Microsoft, where a recalibrated auditing mechanism may have been triggered, indiscriminately purging accounts that failed to meet specific, undisclosed criteria.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.