--- title: Miasma Worm Hits Microsoft Again: Azure Functions Action... description: A forensic analysis of the June 5, 2026 Miasma worm attack on Microsoft's Azure GitHub organizations. A compromised contributor account pushed a malicious... canonical: https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents | daily.dev og:description: A forensic analysis of the June 5, 2026 Miasma worm attack on Microsoft's Azure GitHub organizations. A compromised contributor account pushed a malicious... og:url: https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant og:image: https://api.daily.dev/og/posts/kDc5M9aNT.png og:image:alt: Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 8 min read · 2 upvotes · 1 comments ## Summary A forensic analysis of the June 5, 2026 Miasma worm attack on Microsoft's Azure GitHub organizations. A compromised contributor account pushed a malicious commit to Azure/durabletask containing five configuration files targeting four developer tools: Claude Code, Gemini CLI, Cursor, and VS Code. Each file triggers automatic execution of a 4.6 MB obfuscated credential-harvesting JavaScript payload when a developer opens the repository. GitHub disabled 73 Microsoft repositories in a 105-second automated sweep, including Azure/functions-action, breaking CI/CD pipelines for developers worldwide. The attack marks a significant evolution from package registry poisoning to editor-level hijacking, bypassing traditional supply chain defenses focused on package install hooks. The incident is linked to the TeamPCP threat group behind the broader Miasma worm campaign. Remediation steps include rotating all credentials, checking for persistence mechanisms, auditing repositories for suspicious config files, and pinning GitHub Actions to commit SHAs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Community discussion Top comments from developers on daily.dev. **@hanzo** · 0 upvotes > Damn, speed running from "don't run random shell scripts" to "don't open random folders" is crazy. ## Similar posts on daily.dev - [GitHub disables Microsoft repos pushing password-stealing malware](https://daily.dev/posts/github-disables-microsoft-repos-pushing-password-stealing-malware-oglknbpvl) · BleepingComputer · 1 upvotes · 0 comments - [Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack](https://daily.dev/posts/self-replicating-miasma-worm-hits-73-microsoft-github-repositories-in-supply-chain-attack-eezfvgg3x) · The Next Web · 2 upvotes · 0 comments - [GitHub nukes 70\+ Microsoft repos, breaks CI/CD pipelines, following suspected worm infections](https://daily.dev/posts/github-nukes-70-microsoft-repos-breaks-ci-cd-pipelines-following-suspected-worm-infections-7xwieyhc9) · The Register · 75 upvotes · 13 comments - [Microsoft pulled 73 GitHub repos after malware attack — but still won’t say who’s compromised](https://daily.dev/posts/microsoft-pulled-73-github-repos-after-malware-attack-but-still-won-t-say-who-s-compromised-klwp4mgla) · The New Stack · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ai-agents](https://daily.dev/tags/ai-agents), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents","url":"https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant"},"datePublished":"2026-06-06T11:03:09.477Z","dateModified":"2026-06-06T11:03:38.381Z","description":"A forensic analysis of the June 5, 2026 Miasma worm attack on Microsoft's Azure GitHub organizations. A compromised contributor account pushed a malicious...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1ca1df62c1f5a2956c32e1c6bf865af?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/c1ca1df62c1f5a2956c32e1c6bf865af?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,cyber,ai-agents,github-actions","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-su-kdc5m9ant","comment":[{"@type":"Comment","text":"Damn, speed running from “don’t run random shell scripts” to “don’t open random folders” is crazy.","datePublished":"2026-06-07T15:10:59.537Z","url":"https://daily.dev/posts/kDc5M9aNT#c-q4y0D8QQt","author":{"@type":"Person","name":"hanzo","url":"https://daily.dev/hanzo","image":"https://media.daily.dev/image/upload/s--vKizbc8n--/f_auto/v1777390310/avatars/avatar_SNpELuiA1OUL64g4ciFyI?_a=BAMAMiWQ0"}}]} ```