Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack

Key Points:

• Miasma Worm has compromised 73 Microsoft GitHub repositories, including Azure and MicrosoftDocs, as part of a self-replicating supply chain attack.
• The attack has led to the disabling of access to affected repositories, with implications for the integrity of software delivery in open-source ecosystems.
• Immediate actions include disabling access to compromised repositories and conducting a thorough audit of repository permissions and security practices.

Technical Details: The Miasma Worm is assessed as a variant of the Mini Shai-Hulud worm, leveraging legitimate channels for propagation without exploiting vulnerabilities in npm or GitHub. It executes malicious payloads through developer tools once repositories are cloned.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploitation for Client Execution (Execution)
• T1553.001 - Subvert Trust Controls: Code Signing (Defense Evasion)

IOCs Mentioned: None mentioned