17 Jun 2026 5 min read Cybersecurity

Miasma Worm Hits 73 Microsoft GitHub Repos via AI Tools

The Miasma worm has compromised 73 Microsoft GitHub repositories by weaponising AI coding tools as its trigger mechanism. Using a previously breached contributor account that was never fully remediated, the self-replicating payload harvests credentials from developer environments — and the blast ...

A self-replicating worm called Miasma has compromised 73 Microsoft-owned GitHub repositories by exploiting a previously breached contributor account, injecting credential-harvesting payloads that activate inside popular AI coding tools. GitHub has disabled the affected repositories, but the attack exposes a dangerous new frontier: supply chain worms that weaponise AI development environments as their trigger mechanism.

Why This Matters Right Now

Supply chain attacks are no longer a theoretical risk — they are arguably the dominant attack vector of 2026. Miasma does not simply compromise code; it turns the tools developers trust most, including AI coding assistants like Claude Code, Cursor, and Gemini CLI, into unwitting delivery mechanisms. If your team uses any Azure-related GitHub Actions or open-source Azure packages, you need to assess your exposure today.

What Is Happening

Between June 5 and June 7, 2026, a threat actor using a previously compromised Microsoft contributor account pushed a malicious commit into Azure/durabletask, a core Microsoft repository used for orchestrating serverless workflows. The commit was deceptively titled "Switched DataConverter to OrchestrationContext" — a plausible, routine-sounding change designed to slip past casual reviewers.

Hidden inside were configuration files engineered to execute a credential-harvesting JavaScript payload the moment a developer opened the repository in an AI coding tool such as Claude Code, Cursor, VS Code, or Gemini CLI. This is a critical distinction: the payload did not require traditional binary execution. It activated silently through repository open events within these tools.

Self-Replicating Propagation

What makes Miasma genuinely novel is its self-replicating behaviour. Once the initial repository was seeded, the worm propagated laterally across 73 repositories spanning four Microsoft GitHub organisations: Azure, Azure-Samples, Microsoft, and MicrosoftDocs. Affected projects included Azure Functions, Durable Task components, Azure Samples, and Microsoft documentation repositories.

Security firm StepSecurity, which led early disclosure, noted that the official Azure/functions-action GitHub Action — used by thousands of developers to deploy Azure Functions — was among the disabled repositories, causing immediate downstream disruption. GitHub's automated enforcement systems eventually detected and disabled all 73 repositories, but not before the payload had been live for multiple days.

An Evolved Threat, Not a New One

The approximately 4.6 MB JavaScript payload, partially deobfuscated and briefly published on X/Twitter on June 9, 2026 (subsequently removed), was analysed in depth by Security Joes' incident response team. Their static code analysis confirmed the payload was a variant of an earlier worm family called Shai-Hu (also referred to as Mini Shai-Hulud), meaning Miasma is not a first-generation threat — it is an evolved, more capable iteration of an already-known campaign.

Critically, researchers at The Hacker News noted that the compromised contributor account involved in this June attack was the same account implicated in a Miasma attack on Microsoft the previous month. This strongly suggests the original credential compromise was never fully remediated — a systemic gap we shall return to below.

Why It Matters

The Miasma campaign represents a qualitative escalation in supply chain attack sophistication for two principal reasons.

AI Coding Tools as an Attack Surface

Firstly, it demonstrates that AI coding tools have become an attack surface, not merely a productivity aid. By embedding malicious configuration files (such as .cursorrules, CLAUDE.md, and .vscode/settings.json) that trigger on repository open events, attackers can harvest cloud credentials, tokens, and secrets from developers' local environments and CI/CD pipelines (Continuous Integration/Continuous Deployment — automated build and release workflows) without ever needing to execute a traditional binary.

The payload activates silently inside a trusted, sandboxed-feeling tool — exactly where developers let their guard down. This is a novel trigger surface that most security teams have not yet fully modelled in their threat frameworks.

Broken Credential Hygiene

Secondly, the reuse of a previously compromised account that was apparently never fully rotated out of Microsoft's contributor ecosystem is a stark reminder that credential hygiene in open-source contribution chains is systemically broken. When the same wound reopens a month later at the hub of a new compromise, it signals that incident response stopped short of full remediation.

For organisations that depend on Microsoft's open-source Azure ecosystem — which includes a significant portion of the enterprise cloud development world — this is not an abstract concern. Downstream consumers of azure-functions-action and related packages may have already pulled compromised versions into their own CI/CD pipelines.

PyPI Dependencies Also Affected

It is worth noting that the attack's blast radius extended beyond GitHub. Phoenix Security reported that 37 PyPI wheels (pre-built Python package distributions) were also implicated in the broader Miasma campaign during the same June 5–7 window. This means Python dependency chains represent an additional vector requiring immediate audit, as discussed in the recommendations below.

What You Should Do

Immediate Actions (Do These Today)

Audit your CI/CD pipelines for any references to the 73 disabled Microsoft repositories. Check GitHub Actions workflows for uses: Azure/functions-action and any azure- prefixed actions pinned to non-SHA commit references.
Pin GitHub Actions to full commit SHAs, not branch names or mutable version tags. Tags can be overwritten; SHA pins cannot. For example, use uses: Azure/functions-action@<full-sha> instead of uses: Azure/functions-action@v1.
Rotate cloud credentials and tokens for any developer or CI/CD system that cloned or opened affected repositories between June 5–9, 2026. Prioritise Azure service principals, GitHub PATs (Personal Access Tokens), and any secrets stored in .env files or IDE configurations.
Check your PyPI dependencies: As noted above, 37 PyPI wheels were implicated in the same campaign window. Run pip audit or use a software composition analysis (SCA) tool against your Python dependency trees.
Review AI coding tool configurations: If your team uses Claude Code, Cursor, VS Code with Copilot, or Gemini CLI, check whether any of these tools auto-execute repository configuration files (.cursorrules, CLAUDE.md, .vscode/settings.json) on open. Disable auto-execution of untrusted config files in tool settings immediately.
Integrate Miasma detection content: Security Joes published detection indicators based on their static analysis of the leaked payload. Integrate these into your SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response) tooling without delay.

Longer-Term Hardening

Implement OIDC-based authentication (OpenID Connect — a protocol for short-lived, federated identity tokens) for CI/CD pipelines instead of long-lived static credentials. Short-lived tokens dramatically reduce the blast radius of any credential harvest.
Enable GitHub's push protection and secret scanning on all repositories, including forks. Miasma's payload relied on secrets being accessible post-compromise.
Adopt a dependency review workflow: Use GitHub's Dependency Review Action or equivalent to block pull requests that introduce newly flagged vulnerable or malicious packages.
Establish contributor account hygiene policies: Require periodic re-verification and credential rotation for all contributors with write access to critical repositories — especially after any security incident involving their account. As discussed earlier, the failure to fully remediate the compromised account from May's attack directly enabled June's broader compromise.

The Bigger Picture

Miasma is not an isolated incident — it is a data point in a clear trend. Supply chain attacks have evolved from one-off package poisoning (think SolarWinds, XZ Utils) toward persistent, self-replicating campaigns that treat the software development ecosystem itself as the attack surface.

The integration of AI coding tools into every developer's daily workflow has created a new class of trigger mechanism that security teams have not yet fully modelled in their threat frameworks. The MITRE ATT&CK techniques at play here — T1195.002 (Supply Chain Compromise: Software Dependencies), T1587.001 (Develop Capabilities), and credential access via development tool abuse — are increasingly being chained together in ways that outpace traditional perimeter and endpoint defences.

The industry's response must shift from reactive patching to proactive supply chain integrity. This means cryptographic signing of commits and packages, zero-trust CI/CD architectures, and — perhaps most urgently — treating AI coding tool configuration files with the same suspicion we would afford any executable code. The window between compromise and detection in this case was measured in days. For the organisations downstream, that window may prove to have been more than enough.