Microsoft Breached Again: 73 GitHub Repositories Disabled for Credential-Stealing Malware

Microsoft has disabled 73 of its own repositories on GitHub after a series of its official open-source packages were compromised to inject code capable of stealing credentials. The payload remains inert during installation and only activates when a developer opens the repository in an AI programming agent, such as Claude Code, Gemini CLI, Cursor, or VS Code.

This is the second breach in a few weeks affecting an official Microsoft account: in mid-May, the security company StepSecurity had already documented the poisoning of the durabletask package, a framework for orchestrating distributed workflows that totals around 400,000 downloads per month.

How the Attack Works

The wave started from a malicious commit pushed to the durabletask repository through the account of a collaborator already compromised. From there, the deactivation propagated in a cascading effect: OpenSourceMalware, a site that collects indicators of attacks on the software supply chain, reports that GitHub disabled the 73 repositories in four distinct organizations (the entire Azure Functions, the Durable Task family, and some AI sample apps) in a single automated move lasting 105 seconds on June 5.

The malicious code is tracked as Miasma and is essentially a clone of the Mini Shai-Hulud toolkit, whose source code was recently made public by the TeamPCP group, already responsible for a long series of supply chain attacks in the first half of the year. The payload, weighing about 28 KB, steals credentials from AWS, Azure, GCP, Kubernetes, password managers, and over ninety configurations of developer tools, then moves laterally within cloud infrastructures to other machines. Cloudsmith adds that the code also targets OIDC tokens used in SLSA provenance attestations, which are cryptographic guarantees on software integrity: the same function that should certify the authenticity of a package is bent to steal a legitimate Microsoft token.

The Ambiguous Message from GitHub

GitHub, owned by Microsoft, did not flag the packages as malicious: the page shown to those attempting to access them speaks generically of a “violation of terms of service” and invites the owner to contact support. For developers who worked on those repositories with an AI agent, the wording matters, as their machines should be considered compromised, resulting in credential rotation. Microsoft only acknowledged the possibility of malicious content on Monday, with a circumstantial statement: “We have temporarily removed some repositories while we investigate potential malicious content.”

It is still unclear whether the attack is a reuse of credentials that were never rotated after the May compromise or a completely new breach. OpenSourceMalware leans towards the former hypothesis and openly talks about “re-compromise.” The practical guidance for anyone who opened those packages with an AI assistant remains the same, regardless of the response: treat the machine as compromised and rotate every reachable credential.