Microsoft Corporation

Summary

Microsoft experienced a supply chain attack in which the Miasma worm compromised 73 of its GitHub repositories by pushing a commit that added configuration files for AI coding tools such as Claude Code, Gemini CLI, Cursor and VS Code. When developers opened those repositories in the affected tools, a credential‑harvesting payload executed, stealing tokens for cloud platforms, developer services and npm, which the worm then used to propagate to additional repositories. GitHub automatically disabled the affected repositories within a short period, disrupting CI/CD pipelines that relied on the Azure/functions‑action GitHub Action. The attack did not modify source code but relied on trusted contributor credentials that had been previously exposed in a PyPI package compromise linked to the same threat group. The incident highlighted how malicious configuration files can evade traditional defenses that focus on package installation hooks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 16 2026 the core modules of the Miasma worm payload were authored and the command‑and‑control domain git-service[.]com was registered. Three days later, on May 19 2026, a compromised publishing token was used to upload three malicious versions of Microsoft’s official durabletask Python package to PyPI; the packages remained available for approximately 35 minutes before Microsoft confirmed the compromise and removed them. On June 3 2026 a second wave of Miasma‑themed dead‑drop repositories began to appear. The following day, June 5 2026, a malicious commit identified by hash 5f456b8 was pushed to the Azure/durabletask repository using the same contributor account that had been compromised in the May 19 PyPI incident; the commit was backdated to 2020, included a [skip ci] flag to evade CI detection, and added only configuration files without altering any source code. Those configuration files—.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, and the npm test script—were designed to trigger automatic execution of a 4.3–4.6 MB obfuscated JavaScript payload stored in .github/setup.js when a repository was opened in AI coding tools such as Claude Code, Gemini CLI, Cursor, or Visual Studio Code. Upon execution the payload harvested credentials for AWS, Azure, GCP, Kubernetes, npm, GitHub, and over 90 developer tool configurations, which were then used to propagate the worm to any repository accessible by the compromised accounts. The attack affected 73 repositories across the Azure, Azure‑Samples, Microsoft, and MicrosoftDocs GitHub organizations, including notable projects such as azure-search-openai-demo-purviewdatasecurity, Connectors-NET-LSP, the durabletask family of implementations (.NET, Go, Java, JS, MSSQL, Netherite, protobuf), functions-container-action, llm-fine-tuning, and windows-driver-docs.

The activation of the worm caused immediate disruption to continuous integration and delivery pipelines worldwide, most notably by disabling the Azure/functions-action and functions-container-action GitHub Actions that organizations rely on to deploy Azure Functions; workflows referencing these actions failed to resolve. The harvesting of credentials enabled the worm to generate new malicious commits in downstream repositories, creating a self‑reinforcing propagation loop that amplified the blast radius as each compromised account provided fresh tokens for further spread. Critical Azure infrastructure and documentation repositories were rendered inaccessible during the incident, and developers reported widespread breakage of CI/CD workflows that depended on the affected GitHub Actions. The malicious activity remained indistinguishable from routine updates because it leveraged valid contributor credentials and standard publishing mechanisms, thereby bypassing traditional defenses that focus on package installation hooks.

GitHub responded by disabling the 73 affected repositories in an automated sweep that lasted 105 seconds, occurring between 16:00:50 and 16:02:35 UTC on June 5 2026. Microsoft confirmed the compromise of the durabletask PyPI packages, removed the malicious versions from the repository, and subsequently yanked the affected versions from its internal distribution channels. Security researchers from StepSecurity published analysis linking the Miasma worm to the earlier Mini Shai‑Hulud worm and to the threat group TeamPCP, noting shared infrastructure and the reuse of the compromised contributor account across both the May 19 PyPI attack and the June 5 GitHub incident. The researchers also documented the worm’s use of configuration files to trigger code execution in AI coding agents and IDEs, highlighting the shift in attack surface from package managers to developer tool configuration files. The full scope of downstream impact, including the total number of developer accounts that may have been compromised, remains undetermined.

Sources

Sources available to members: 2 sources.