The Miasma Worm Hid in Microsoft's Code and Ran the Moment You Opened It

Thu, 11 Jun 2026 12:08:30 +0200

GitHub disabled 73 of Microsoft’s own repositories in 105 seconds, after a worm called Miasma planted a credential stealer inside Microsoft’s Azure code on GitHub.

The part that makes this different is how it ran. A developer did not need to build the project or install a package. Opening one of those repositories in an AI editor, VS Code, Claude Code, Cursor, or Gemini, was enough to set it off. 😱

Miasma on HackingPassion.com : root@HackingPassion.com-[~]

The Miasma Worm Hid in Microsoft's Code and Ran the Moment You Opened It