When Your Coding Buddy Becomes a Chinese Spy: The GitHub Heist Nobody Saw Coming

About this episode

The episode discusses the Miasma campaign and its implications for software supply chain security, particularly regarding GitHub and AI coding tools.

This is your Digital Frontline: Daily China Cyber Intel podcast. I’m Ting, and today’s China cyber picture is less “slow boil” and more “packet storm.” In the past 24 hours, the clearest fresh signal is the Miasma campaign, which Complex Discovery says forced 73 Microsoft GitHub repositories offline by abusing AI coding agents, a reminder that Chinese-linked or China-adjacent operators are increasingly interested in the software supply chain, not just the perimeter. Complex Discovery reports the key lesson is that attackers are now targeting the tools developers trust, turning assistants into attack surfaces instead of helpers. For US interests, that matters because the blast radius stretches far beyond one repo. Software firms, cloud teams, and any organization using GitHub-connected automation should assume that code review, secret scanning, and dependency control are now front-line defenses. The more AI gets welded into development workflows, the more a poisoned prompt, compromised token, or malicious workflow can become a springboard into broader infrastructure. The sector exposure is broad, but the highest-risk groups right now are technology vendors, defense suppliers…

People in this episode

Host: Ting

Topics covered

• cybersecurity
• software supply chain
• AI in development
• Chinese cyber activity
• GitHub security
• Miasma campaign

Keywords

• cybersecurity
• Miasma campaign
• GitHub
• AI coding agents
• software supply chain
• Chinese cyber activity
• DevOps
• Microsoft
• Complex Discovery

Mentioned in this episode

Organizations: Microsoft, Complex Discovery, GitHub, US, Chinese, DevOps

More episodes of Digital Frontline: Daily China Cyber Intel

• China's Catfishing Your CISO: When Dream Jobs Come With Malware and Military Intel Strings Attached · June 10, 2026 · 4 min
• China Ditches Flashy Hacks for Your Boring Password and It's Working Way Too Well · June 7, 2026 · 5 min
• Beijing's AI-Powered Phishing Gets Too Good: Why Your CEO's Inbox Is Now a Battlefield · June 5, 2026 · 4 min
• Beijing's Big Patient Hack: Why China Is Camping Out in Your Router Right Now · June 3, 2026 · 4 min
• China's Playing the Long Game: Why Your Boring Old Passwords Are Still Their Favorite Snack · May 20, 2026 · 4 min
• Beijing Bullies Zambia Into Canceling Tech Conference After Taiwan Shows Up to the Party · May 4, 2026 · 4 min