Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Agents

A forensic analysis of the June 5, 2026 Miasma worm attack on Microsoft's Azure GitHub organizations. A compromised contributor account pushed a malicious commit to Azure/durabletask containing five configuration files targeting four developer tools: Claude Code, Gemini CLI, Cursor, and VS Code. Each file triggers automatic execution of a 4.6 MB obfuscated credential-harvesting JavaScript payload when a developer opens the repository. GitHub disabled 73 Microsoft repositories in a 105-second automated sweep, including Azure/functions-action, breaking CI/CD pipelines for developers worldwide. The attack marks a significant evolution from package registry poisoning to editor-level hijacking, bypassing traditional supply chain defenses focused on package install hooks. The incident is linked to the TeamPCP threat group behind the broader Miasma worm campaign. Remediation steps include rotating all credentials, checking for persistence mechanisms, auditing repositories for suspicious config files, and pinning GitHub Actions to commit SHAs.