# Miasma Worm Hijacks 73 Microsoft GitHub Repos by Targeting AI Coding Tools

*2026-06-15 02:02 UTC · Technology · 1 min read*

> A self-replicating worm exploited AI coding tools like Claude Code and Cursor to infect 73 Microsoft GitHub repositories and steal cloud credentials.

A self-replicating supply chain malware called "Miasma" compromised 73 Microsoft GitHub repositories on June 5, 2026, exploiting a novel attack vector: AI coding assistants. The worm planted malicious configuration files in repos across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations. When a developer cloned an infected repo and opened it in tools like Claude Code, Cursor, or Gemini CLI, the payload executed automatically — harvesting cloud credentials for AWS, Azure, GCP, Kubernetes, npm, and GitHub.

Security researchers describe Miasma as the first supply chain attack to treat AI coding agents as the primary attack surface rather than package managers. Unlike traditional malware, it bypassed standard security scanners because the repositories themselves appeared clean; the malicious trigger only fires inside AI-powered IDEs, where most detection systems do not yet look. GitHub automated systems disabled all affected repositories in just 105 seconds, but the scope of downstream developer exposure remains unclear.

The full Miasma attack toolkit was made public on GitHub on June 9, raising concerns about copycat campaigns. Developers are advised to audit their AI coding tool configurations and rotate any credentials that may have been exposed through affected repositories.

## Sources

- [thehackernews.com](https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html)
- [theregister.com](https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074)
- [stepsecurity.io](https://www.stepsecurity.io/blog/miasma-worm-hits-microsoft-again-azure-functions-action-and-72-other-repositories-disabled-after-supply-chain-attack-targeting-ai-coding-agents)

---
TechTools News · https://techtools.cz/tools/news/article/1832-miasma-worm-hijacks-73-microsoft-github-repos-by-targeting-ai-coding-tools
Česká verze: https://techtools.cz/tools/news/clanek/1905-cerv-miasma-napadl-73-repozitaru-microsoftu-na-githubu-cilenim-na-nastroje-pro