Cybersecurity

73 Microsoft Packages Weaponized to Deploy Password Stealer Malware

34 sec read19 views0 listens

A self-replicating worm named Miasma recently compromised 73 Microsoft GitHub repositories by weaponizing the durabletask PyPI package to steal developer credentials and Azure OIDC authentication tokens. This incident is critical for tech professionals as it exposes a major supply-chain vulnerability within the Azure ecosystem and necessitates immediate audits of CI/CD pipelines and package installation hooks. The speed and scale of the attack highlight a growing requirement for organizations to adopt more rigorous security practices, such as pinning actions to full commit SHAs and implementing automated secret rotation.

Read the full article at Cyber Security News

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

GitHub Hacks Highlights Need for Repository Security

A recent GitHub attack, codenamed Megalodon, saw over 5,000 malicious commits pushed to repositories within six hours, highlighting the need for enhanced security measures in software development environments. This underscores the vulnerability of co...

Ali Nemati

CybersecurityMay 2026 sec read

GitHub says internal repositories were taken in poisoned VS Code extension attack

GitHub confirmed that internal repositories were compromised after an employee's device was infected by a malicious Visual Studio Code extension, highlighting the increasing risks to software development platforms and third-party tools. This incident...

Ali Nemati

CybersecurityMay 2022 sec read

GitHub Hacked - Internal Source Code Repositories Compromised via Employee Device

GitHub confirmed a security breach involving unauthorized access to internal repositories through a compromised Visual Studio Code extension used by an employee. This incident highlights the increasing threat of supply chain attacks targeting develop...

Ali Nemati

CybersecurityMay 824 sec read

New Infostealer Campaign Uses GitHub Releases for Payload Hosting and Evasion

A new cyberespionage campaign dubbed "HumanitarianBait" uses phishing emails to deliver malware disguised as humanitarian aid requests, with the payload hosted on GitHub to evade detection. This tactic leverages trusted platforms to hide malicious ac...

Ali Nemati

AI & Machine LearningApr 3025 sec read

Stop Slacking your secrets. Use GitHub instead.

A new tool called boltenv allows developers to securely manage environment variables by leveraging GitHub permissions directly, eliminating the need for additional access control lists or accounts. This approach ensures that when a developer loses ac...

Ali Nemati

73 Microsoft Packages Weaponized to Deploy Password Stealer Malware

Related Articles

GitHub Hacks Highlights Need for Repository Security

GitHub says internal repositories were taken in poisoned VS Code extension attack

GitHub Hacked - Internal Source Code Repositories Compromised via Employee Device

New Infostealer Campaign Uses GitHub Releases for Payload Hosting and Evasion

Stop Slacking your secrets. Use GitHub instead.