Miasma Worm Infects 73 Microsoft GitHub Repositories

Microsoft disclosed a self-spreading worm that infected 73 of their GitHub repositories before being detected and stopped. The worm, named Miasma by researchers, exploited misconfigured GitHub Actions workflows to propagate across repositories and exfiltrate cloud credentials.

The attack started with a compromised personal access token. That token had access to multiple repositories and triggered workflow runs. The malicious workflow modified repository code to include the worm payload, then committed those changes back to the repository.

When other repositories pulled the infected code, their workflows ran the payload. The worm collected environment variables and secrets, uploaded them to attacker-controlled infrastructure, then attempted to spread to any repositories the compromised token could access.

Microsoft detected the anomalous workflow runs through their security monitoring. The worm had been active for approximately six hours before detection. During that time, it spread to 73 repositories across multiple Microsoft GitHub organizations.

The incident response involved revoking the compromised token, removing the malicious commits, and scanning for any additional persistence mechanisms. Microsoft reports no evidence of further compromise beyond credential exposure.

The worm is interesting because it demonstrates how CI/CD systems can become propagation vectors. Each infected repository becomes a launch point for further infections. The blast radius depends on how permissive the initial compromise was.

Defending against this type of attack requires strict separation of CI/CD permissions. Workflows should not have write access to repository code. Personal access tokens should be scoped to the minimum necessary repositories. And runtime detection for anomalous workflow behavior is essential.

GitHub has since added new security features for Actions, including mandatory approval for workflows making repository changes from fork pull requests. But the core problem remains: CI/CD systems have powerful access, and when compromised, they can spread quickly.