Cases › security breach › LR-2026-0596
Miasma worm supply chain attack targets Microsoft Azure repositories and AI coding tools (June 5, 2026)
Confirmed Why: StepSecurity research · StepSecurity · 2 independent reports
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity major: Test: many third parties with a stated count of two or more. Fact: 20+ developers reported broken CI/CD pipelines.
A malicious commit was pushed to Microsoft's Azure/durabletask GitHub repository on June 5, 2026, using a previously compromised contributor account. The commit added configuration and payload files designed to run a credential-harvesting script when a developer opened the repository in an AI coding tool or IDE, including Claude Code, Gemini CLI, Cursor and VS Code. GitHub's automated abuse detection then disabled 73 repositories across four Microsoft GitHub organizations within a 105-second window. The disablement broke Azure/functions-action, the official GitHub Action for deploying Azure Functions, and developers reported broken CI/CD pipelines. Microsoft first described the outage as a GitHub policy violation and later as an internal management issue under investigation.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
ModelSafety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring
Infrastructure / targetKnown flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters
Similar incidents
Evidence
- When it happened 2026-06-05
No source states: a step-by-step account, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show every field, with its source and grade
What happened
Impact
LR-2026-0596 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON