Daily · 2026-06-08
🇲 Miasma Hits 73 MS GitHub Repos, 🛡️ C0XMO Botnet Targets DD-WRT, 🔒 OpenAI ChatGPT Lockdown Mode, 🕵️♂️ SRG Fast-Flux Exposed, 🧱 VerdantBamboo pfSense BRICKSTORM, 📱 Instagram AI Hack Confirmed
Miasma worm hits 73 Microsoft GitHub repositories in the most aggressive supply chain attack on AI coding agents to date — planted config files execute credential harvesters when developers open repos in Claude Code, Cursor, or VS Code. Plus: C0XMO botnet exploits DD-WRT buffer overflow with multi-arch support, OpenAI rolls out ChatGPT Lockdown Mode blocking prompt injection exfiltration, Silent Ransom Group fast-flux infrastructure exposed across multiple continents, VerdantBamboo BRICKSTORM variant deployed on MSP pfSense firewalls, and Meta confirms 20,225 Instagram accounts hacked via AI support tool abuse.
The Miasma worm's compromise of 73 Microsoft GitHub repositories is the day's defining story. A backdated commit to Azure/durabletask planted configuration hooks that execute a credential-harvesting payload when repositories are opened in Claude Code, Cursor, or VS Code, and the fallout broke Azure CI/CD pipelines that depend on functions-action@v1. The worm steals cloud, registry, and AI tooling credentials and then propagates to every repository the victim can write, so the blast radius is measured in ecosystems rather than accounts. The pivot from package install to folder open defeats registry-centric defenses and makes every repository a potential entry point.
VerdantBamboo's BRICKSTORM campaign keeps compounding: a FreeBSD variant of the backdoor on an MSP's pfSense firewall bought 18 months of access and a pivot to a Synology NAS, with network edge appliances lacking EDR coverage as the recurring beachhead. The C0XMO botnet is meanwhile spreading through a six-year-old DD-WRT buffer overflow and actively killing rival malware, a sign of consolidation in the IoT botnet market.
Watchlist: audit for unexpected .claude, .cursor, and .vscode configuration files, quarantine any host that opened affected repositories, rotate cloud and registry tokens, and treat every edge appliance as a possible initial-access point.