Miasma Worm Prompts 105-Second GitHub Takedown; Meta Flaw Hijacked 20,225 Accounts
· 9:31 · Watch on YouTube ↗
Summary
The Miasma worm led GitHub to remove 73 Microsoft repositories in 105 seconds. The roundup also covers IronWorm, an Instagram account-recovery flaw linked to 20,225 hijacked accounts, and Chrome’s device-bound session credentials.
Key points
- IronWorm targeted crypto/web3 and other software developers, collected secrets from infected hosts, and used an eBPF kernel rootkit and Tor to communicate with its C2 server.
- Miasma, described as a MiniSha Halua worm variant, affected Red Hat Cloud Service NPM packages and later appeared in Microsoft-owned repositories.
- GitHub removed 73 Microsoft repositories across four organizations within a 105-second window after its automated systems flagged them as malicious.
- Step Security reported that the same contributor account was used again to push a malicious commit to the Durable Task repository; the presenter said credentials may not have been fully rotated.
- A Meta account-recovery flaw failed to verify that a password-reset email matched the Instagram account. The roundup reports 20,225 accounts were hijacked.
- Chrome rolled out device-bound session credentials, which bind user sessions to computer hardware and make stolen session cookies harder to use.
Article Details
- Topics
- [00:27] IronWorm and Miasma target developer ecosystems and collect information from infected hosts
- [01:36] Miasma's impact on Red Hat packages and the removal of Microsoft-owned GitHub repositories
- [05:34] Massachusetts Consumer Data Privacy Act
- [06:07] Meta AI account-recovery flaw and Instagram account takeovers
- Chrome device-bound session credentials
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelIronWorm used Tor to communicate secrets collected from infected hosts to its C2 server.T1195.001 · Compromise Software Dependencies and Development ToolsMiasma affected NPM packages and Microsoft repositories, while IronWorm infected a project on GitHub, supporting software supply chain compromise.
Threat Actors
Malware
Products
GitHubThe platform hosted affected projects and repositories; its automated abuse-detection systems flagged malicious repositories and triggered their removal.Google ChromeChrome rolled out device-bound session credentials that bind user sessions to computer hardware, making stolen session cookies harder for attackers to use.Meta AIResearchers used the Meta AI chatbot in the account-takeover flow, which exploited a separate bug that failed to verify the reset email against the Instagram account.