---
title: "GitHub disables Microsoft repos pushing password-stealing malware"
url: https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl
source_url: https://www.bleepingcomputer.com/news/security/github-disables-microsoft-repos-pushing-password-stealing-malware
type: article
source: "BleepingComputer"
published: 2026-06-09T15:44:57.180Z
updated: 2026-06-09T15:45:21.882Z
tags: ["cyber", "python", "github", "azure", "malware"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub disables Microsoft repos pushing password-stealing malware

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments

## Summary

GitHub disabled 73 Microsoft repositories across Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on June 5 after a Miasma/Shai-Hulud supply-chain attack injected password-stealing malware. The incident lasted only 105 seconds before containment, but disrupted CI/CD pipelines — notably breaking the 'Azure/functions-action' GitHub Action used to deploy Azure Functions. The same campaign previously compromised 32 Red Hat npm packages and also pushed malicious versions of the 'durabletask' package to PyPI. The attack vector involved compromising a Red Hat employee's GitHub account and injecting workflows that harvested OIDC tokens. All repositories have since been restored, and Microsoft notified affected customers. Researchers note the Miasma worm specifically targeted AI coding tools including Claude Code, Gemini CLI, VS Code, and Cursor. Developers are advised to lock dependencies, delay package updates, and test builds in isolated environments.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/github-disables-microsoft-repos-pushing-password-stealing-malware>

## Similar posts on daily.dev

- [Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents](https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant) · StepSecurity · 2 upvotes · 1 comments
- [GitHub nukes 70\+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections](https://daily.dev/posts/github-nukes-70-microsoft-repos-breaks-ci-cd-pipelines-following-suspected-worm-infections-7xwieyhc9) · The Register · 73 upvotes · 13 comments
- [Microsoft pulled 73 GitHub repos after malware attack — but still won’t say who’s compromised](https://daily.dev/posts/microsoft-pulled-73-github-repos-after-malware-attack-but-still-won-t-say-who-s-compromised-klwp4mgla) · The New Stack · 0 upvotes · 0 comments
- [Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack](https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x) · The Next Web · 1 upvotes · 0 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#github](https://daily.dev/tags/github), [#azure](https://daily.dev/tags/azure), [#malware](https://daily.dev/tags/malware)

[View this post on daily.dev](https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl)