Microsoft Takes Down 73 GitHub Repos After Miasma Malware Infection

Microsoft temporarily disabled more than 70 GitHub repositories after detecting infection by the Miasma malware. The self-replicating worm compromised code across multiple Microsoft organizations, including Azure and MicrosoftDocs. Attackers used compromised tools in popular AI coding apps to steal passwords and credentials.

Microsoft temporarily disabled over 70 repositories after detecting the self-replicating Miasma malware across its Azure and MicrosoftDocs accounts.

The incident involved repositories hosted under Microsoft Azure, Azure-Samples, Microsoft, and MicrosoftDocs accounts. The malware propagated across the repositories by injecting malicious code into their source files. Users interacting with the compromised repositories faced potential exposure of their authentication credentials.

Miasma is a variant of the Mini Shai-Hulud worm originally open-sourced by TeamPCP. The attack chain relied on compromised tools within AI coding applications like Claude Code, Gemini CLI, VS Code, and Cursor. These apps allowed the malware to access stored passwords and credentials during routine operations.

Microsoft has begun restoring some of the affected repositories after completing security reviews. Other projects may remain offline while engineers continue their investigation. The company emphasized that protecting customers and the broader ecosystem remains its top priority during this process.

The exact number of compromised repositories varies in reports, with counts ranging from over 70 to nearly 73. Microsoft confirmed it temporarily removed some repos as it investigated potential malicious content. Some have been restored after review, while others may stay offline until work continues.