73 Microsoft-Softwarepakete missbraucht zum Einsatz von Passwort-Diebstahl

What looked like a routine enforcement action was actually the visible tail end of a quiet, months-long intrusion. The malware is called Miasma, also tracked under the name “The Spring Blight.” It is a worm that spreads across GitHub repositories, stealing developer credentials, and replicating itself into new projects.

The attack touched four of Microsoft’s core GitHub organizations, namely Azure, Azure-Samples, microsoft, and MicrosoftDocs, taking out repositories that millions of developers rely on every single day.

Analysts at OpenSource Malware said in a report shared with Cyber SecurityNews (CSN) that they identified the intrusion and published a detailed breakdown of how the worm moved through Microsoft’s infrastructure.

Technik und Auswirkungen

Their research connected the June 8 incident to a broader campaign involving the Shai-Hulud toolkit, which had previously targeted AWS and GitHub environments. This time, the attackers upgraded their reach to go after Azure credentials specifically. The attack also triggered a cascading failure for developers worldwide.

When GitHub disabled Azure/functions-action, every CI/CD pipeline referencing Azure/functions-action@v1 stopped working immediately. Microsoft’s initial statement described it as an “internal management issue,” only to revise that explanation twelve minutes later once the full scale of the incident became clear.

The compromise was wide enough to shake confidence in Microsoft’s own supply chain. A credential-harvesting worm sitting at the center of the Azure Functions ecosystem is not a minor event, and the speed at which it spread showed the attackers had carefully planned the entire operation.

73 Microsoft Packages Weaponized Miasma’s entry point was the durabletask PyPI package, which sits at the core of Microsoft’s Durable Task framework used across Node.js, Python, Java, Go, JavaScript, MSSQL, Netherite, and protobuf implementations. The attackers pushed three malicious versions, 1.5.1, 1.5.2, and 1.5.3, to PyPI inside a 38-minute window.