Miasma Worm Compromises 73 Microsoft GitHub Repositories

A sophisticated software supply chain attack using a self-replicating worm called Miasma has compromised dozens of Microsoft's GitHub repositories, disrupting development pipelines and raising serious questions about the security of modern development ecosystems. The incident, which occurred on June 5, 2026, led to the temporary removal of 73 repositories across Microsoft's Azure, AzureSamples, and MicrosoftDocs organizations on GitHub.

GitHub staff disabled the repositories within approximately two minutes after automated systems flagged them for terms of service violations. The most immediate impact was the disabling of the "Azurefunctionsaction" GitHub Action, a critical tool used globally to deploy Azure Functions, which caused widespread disruptions to continuous integration and delivery (CI/CD) workflows. Microsoft has since restored all affected repositories after review and notified a small number of customers who may have pulled content from them.

Security researchers have linked this attack to the Miasma worm, an evolved variant of the Mini ShaiHulud malware associated with the threat group TeamPCP. The campaign began earlier in June when attackers compromised a Red...