Miasma Blight Reaches Microsoft: 73 Repos Disabled in 105 Seconds

On June 5, 2026 GitHub automated enforcement disabled 73 Microsoft repositories across four orgs within 105 seconds (flagged as TOS violations), causing global CI breakage for consumers of Azure functions actions. The takedown centers on the durabletask ecosystem — previously compromised via malicious PyPI packages tied to stolen GitHub Actions secrets and attributed to TeamPCP — and is plausibly linked to Miasma, a worm that harvests Azure/GCP credentials and creates attacker-controlled repos and JSON-secret commits; the report details affected repos, impact, and immediate mitigation steps.