Miasma
PulseAugur coverage of Miasma — every cluster mentioning Miasma across labs, papers, and developer communities, ranked by signal.
Microsoft will announce enhanced OIDC token security measures within 60 days
The Miasma attack's ability to bypass Microsoft's repository build pipelines by leveraging legitimate Microsoft OIDC tokens represents a critical security flaw. Given the severity and the direct targeting of Microsoft services, it is highly probable that Microsoft will accelerate the implementation of enhanced security protocols and validation mechanisms for OIDC tokens to prevent similar future compromises.
AI coding agents are becoming a significant attack vector for supply chain compromises
Multiple recent incidents, including the Miasma worm exploiting AI tools to compromise Microsoft GitHub repos and malware activating via AI coding agents, indicate a growing trend. The reliance on AI tools for code development is inadvertently creating new, potent attack vectors that bypass traditional security measures by leveraging developer trust in these AI assistants.
Miasma toolkit will be integrated into commercial exploit-as-a-service offerings within 90 days
The recent open-sourcing of the AI-powered Miasma attack toolkit on GitHub, combined with its demonstrated success in compromising major platforms like Microsoft Azure Repos, suggests a high likelihood of its adoption by commercial cybercrime operations. These operations will likely package Miasma into more accessible exploit-as-a-service offerings, lowering the barrier to entry for sophisticated supply chain attacks.
-
Miasma malware poisons npm packages, targets developer secrets
A sophisticated malware campaign dubbed Miasma has compromised over 20 npm packages, targeting developers by stealing credentials and seeking to expand its reach. The attack specifically affected the Leo Platform and RS…
-
Microsoft Azure Repos Compromised by Miasma Worm; Game Devs Address Companion Dialogue
Microsoft's Azure open-source repositories on GitHub were automatically disabled due to a compromise by the Miasma worm. This incident highlights ongoing supply chain attack risks. Separately, developers of "The Adventu…
-
AI-powered Miasma attack toolkit goes open source on GitHub
A new open-source toolkit named Miasma has been released on GitHub, designed to facilitate supply-chain attacks. This toolkit leverages AI to automate the process of identifying and exploiting vulnerabilities in softwar…
-
Microsoft packages compromised twice with credential-stealing AI malware
Microsoft's official open-source packages have been compromised for the second time in recent weeks, with malicious code designed to steal credentials being injected into 73 packages. This code activates when developers…
-
Miasma worm exploits AI tools to compromise 73 Microsoft GitHub repos
A sophisticated supply chain attack, dubbed Miasma, has compromised 73 Microsoft repositories on GitHub, including critical ones for Azure and MicrosoftDocs. This self-replicating worm, a variant of Mini Shai-Hulud, exp…
-
Miasma malware targets developers via compromised npm packages
A sophisticated malware campaign, dubbed Miasma by Microsoft, has targeted developers by compromising 32 npm packages under the `@redhat-cloud-services` umbrella. This attack plants backdoors in developer tools like Cla…
-
Red Hat npm Miasma campaign steals credentials via 32 malicious packages
A credential-stealing campaign has been uncovered, involving 32 malicious npm packages that affected over 90 versions. These packages were designed to steal credentials, posing a significant security risk to users and s…
-
Red Hat npm packages compromised by credential-stealing worm
More than 30 official Red Hat npm packages were compromised by a credential-stealing worm named Miasma. This variant, similar to the open-sourced Mini Shai-Hulu, was discovered by Aikido Security. The compromised packag…
-
AI discussions span regulation, security, and skill loss across social media
A collection of social media posts discusses various aspects of artificial intelligence, ranging from its use in cybersecurity and potential vulnerabilities to regulatory concerns and its impact on human skills. One pos…