A stealthy malware campaign has turned Microsoft’s own open‑source developer tools into a weapon against the AI engineers who rely on them, exposing how fragile the software supply chain has become.

Early discovery: a worm in Microsoft’s GitHub

Security researchers first sounded the alarm when a self‑replicating worm, dubbed Miasma, was found planted across Microsoft’s GitHub presence. The worm hit 73 repositories in Microsoft’s Azure and related organizations in what was quickly identified as a supply‑chain attack targeting AI development workflows.¹

The malicious payloads were crafted to trigger specifically when opened in AI coding tools such as Claude Code and Cursor, turning these assistants into an execution path for credential theft.¹

Scope of the compromise: AI and cloud developers exposed

Further analysis showed that dozens of cryptographically verified open‑source packages from Microsoft had been compromised to add advanced credential‑stealing code, activated when developers worked with them via AI coding agents.² In all, 73 packages were flagged as malicious when automated GitHub systems blocked them.

The injected payload could steal credentials from major cloud platforms like AWS, Azure, and GCP, as well as Kubernetes, password managers, and more than 90 developer tool configurations, then spread laterally through cloud infrastructure to other developer machines.²

Microsoft’s response and communication gap

As the extent of the breach became clearer, Microsoft cut off access to dozens of its open‑source projects on GitHub while investigating how hackers breached the code and “injected password‑stealing malware into the code,” many of them tools tied to Azure and AI coding apps.³

A Microsoft spokesperson said the company had “temporarily removed some repositories as we investigated potential malicious content,” adding that some had been restored after review while others “may remain offline while work continues.”³ Microsoft also said it had notified “a small number of customers who may have pulled down content from the affected repositories” and would reach out again if further action was needed.³

A pattern of attacks on Microsoft’s software supply chain

Security experts note this is the second such supply‑chain incident in weeks involving official Microsoft repositories. Earlier, a compromise of Microsoft’s durabletask Python SDK on PyPI—used in fault‑tolerant workflows and downloaded about 400,000 times per month—was linked to the same threat actor, known as TeamPCP, and involved related credential‑stealing malware now tracked as Miasma.²

The back‑to‑back incidents underscore how attackers are increasingly targeting trusted open‑source distribution channels, particularly those used by AI‑driven development tools, to achieve maximum reach with minimal direct exposure.

---

[1] The Next Web — "Self-replicating Miasma worm hits 73 Microsoft GitHub repositories in supply chain attack": Report on the Miasma worm compromising 73 Microsoft GitHub repositories and triggering within AI coding tools.

[2] Ars Technica — "For the 2nd time in weeks, Microsoft packages laced with credential stealer": Details on the 73 compromised Microsoft packages, the Miasma malware’s capabilities, and the earlier durabletask SDK incident.

[3] TechCrunch — "Microsoft's open source tools were hacked to steal passwords of AI developers": Coverage of Microsoft disabling dozens of GitHub repositories, its public statements, and customer notification efforts.