Miasma Worm Uses IDE Hooks in Microsoft Repository Attack; 73 Repositories Disabled
Summary
Step Security reports that a June 5 malicious commit added hooks triggering a credential-stealing payload when affected Microsoft repositories were opened in IDEs or AI coding tools. GitHub disabled 73 repositories; Azure/functions-action outages disrupted CI/CD.
Key points
- Step Security says commit 5f456b8 was pushed to Azure/durabletask using a compromised contributor account; five added files included tool configurations and an obfuscated JavaScript payload.
- The planted files triggered the payload when a repository was opened in Claude Code, Gemini CLI, Cursor, or VS Code; the article says cloning alone did not trigger execution.
- The article reports that GitHub disabled 73 repositories across four Microsoft organizations in two waves over 105 seconds, and says its authors verified the repository status through the GitHub API.
- Disabling Azure/functions-action broke workflows referencing its @v1 tag; Microsoft advised alternative deployment methods while it investigated the repository’s status.
- Step Security links the contributor account to a May 19 durabletask PyPI attack, but lists several possible explanations for its reuse and does not establish which occurred.
- The article advises affected users to rotate accessible credentials, audit repositories and package releases, and check network logs for check.git-service[.]com and t.m-kosche[.]com.
Article Details
- Attack Vectors
- A malicious commit was pushed to Azure/durabletask using a compromised contributor account. It added a 4.6 MB obfuscated JavaScript credential harvester and editor/AI-tool configuration files that trigger execution when an infected repository is opened.
- Claude Code and Gemini CLI SessionStart hooks, a Cursor rule, and a VS Code folder-open task all invoke `node .github/setup.js`.
- The commit used a misleading message and a `[skip ci]` flag; its timestamp was backdated and no source code files were modified.
- The article links the June 5 repository attack to the May 19 durabletask PyPI compromise through use of the same contributor account. It reports that the earlier payload harvested credentials and that the June 5 attack shifted from package installation to opening a repository.
- Defensive Notes
- Treat systems as compromised if an affected repository was opened after June 2 in VS Code, Claude Code, Cursor, or Gemini CLI; rotate credentials accessible from those systems.
- Audit repositories for unexpected `.claude/`, `.gemini/`, `.cursor/`, `.vscode/tasks.json`, and `.github/setup.js` files, and audit npm/PyPI packages for unauthorized releases.
- Check network logs for `check.git-service[.]com` and `t.m-kosche[.]com`.
- Require pull-request reviews and prevent direct pushes to main; use PyPI Trusted Publishing (OIDC) instead of long-lived publishing tokens.
- Restrict outbound network access from CI/CD runners and monitor for package releases without corresponding GitHub tags or CI runs.
- Use alternative deployment methods while Azure/functions-action is disabled. When restored, pin GitHub Actions to a commit SHA rather than a mutable tag such as `@v1`.
- Inspect cloned repositories for suspicious editor and AI-tool configuration files before opening them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | check[.]git-service[.]com | C2 domain used by the May 19 payload; the article recommends checking network logs for connections to it. |
| DOMAIN | t[.]m-kosche[.]com | Secondary C2 domain that the article says ties the May 19 payload to TeamPCP infrastructure. |
MITRE ATT&CK
T1059.007 · JavaScriptEditor and AI-tool configuration files invoke `node .github/setup.js`, which runs the obfuscated JavaScript credential-harvesting payload.T1078 · Valid AccountsThe malicious commit was pushed using a contributor account the article identifies as compromised; the same account had been used in the earlier PyPI attack.T1195.002 · Compromise Software Supply ChainA malicious commit injected payload and execution-triggering configuration files into the Azure/durabletask source repository.T1204.002 · Malicious FileOpening the infected repository in a supported editor or AI coding tool triggers the planted configuration to execute the payload.T1562.001 · Disable or Modify ToolsThe commit included `[skip ci]`, which the article says suppressed CI execution to avoid automated detection.
People
Threat Actors
Malware
Vendors
GitHubOn June 5, 2026, the Miasma worm campaign reached Microsoft's Azure GitHub organizations. GitHub disabled 73 repositories across four Microsoft GitHub organizations after a malicious commit was pushed to theMicrosoftOn June 5, 2026, the Miasma worm campaign reached Microsoft's Azure GitHub organizations. GitHub disabled 73 repositories across four Microsoft GitHub organizations after a malicious commit was pushed to the
Products
Azure/functions-actionAzure/azure-functions-durable-python, Azure/azure-functions-sql-extension, Azure/functions-action, microsoft/DurableFunctionsMonitor, microsoft/durabletask-dotnet, microsoft/durabletask-netheriteClaude Codefiles that execute a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code.Cursorexecute a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code.Gemini CLIthat execute a credential-harvesting payload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code.VS Codepayload when a developer opens the repository in Claude Code, Gemini CLI, Cursor, or VS Code.