MalwarePublished 9 Jun 2026

GitHub disables Microsoft repos pushing password-stealing malware

Source Bleeping Computer

Description

On June 5, 2026, Microsoft removed 73 repositories from its GitHub organizations due to concerns over distribution of password-stealing malware linked to the Miasma/Shai-Hulud supply-chain campaign. The incident caused disruption to continuous integration pipelines, notably disabling the Azure/functions-action GitHub Action temporarily. The repositories were restored and deemed clean after investigation. Microsoft notified affected customers and continues to investigate. The malware campaign targeted open-source ecosystems, including prior compromises of Red Hat npm packages and Python packages on PyPI. No confirmed exploits in the wild have been reported for this specific incident.

Impact

The immediate impact was disruption of continuous integration workflows, including outages of Azure Functions deployment pipelines due to removal of affected repositories. Potential exposure to password-stealing malware existed through compromised repositories and packages, though no confirmed exploitation in the wild has been reported. The incident highlights risks in software supply chains and the potential for widespread disruption in developer ecosystems.

Defensive guidance

Microsoft has restored all affected repositories and confirmed they are clean and safe to use. Customers who may have pulled content from the affected repositories have been notified. Microsoft is continuing its investigation and will communicate directly if further customer action is required. Developers are advised to lock project dependencies, introduce delays in fetching new package updates, and test builds in isolated environments to mitigate supply-chain risks. No immediate action is required beyond following official communications from Microsoft.

Summary

Microsoft's GitHub repositories across Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations were disabled by GitHub staff due to violations of terms of service after being compromised in a supply-chain attack linked to the Miasma/Shai-Hulud malware campaign. The campaign involved injecting malicious workflows to steal credentials via GitHub OIDC tokens. The 'durabletask' repository was compromised in May, and malicious versions of the package were pushed to PyPI. The June 5 incident was contained within 105 seconds, and all repositories have since been restored and verified clean. The attack is part of a broader supply-chain threat targeting open-source AI coding tools and ecosystems. Microsoft has notified impacted customers and is continuing investigations.

References

bleepingcomputer.com/news/security/github-disables-microsoft-repos-pushing-password-stealing-malware/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jun 2026, 15:55 UTC

References

Community reviews