Instagram AI hack, Android zero-day and Miasma worm hit GitHub

Three separate security incidents were disclosed this week affecting consumer accounts, mobile devices and developer infrastructure.

Meta reported that attackers abused an Instagram High Touch Support chatbot to link attacker-controlled email addresses to user accounts and then reset passwords. The company identified 20,225 potentially compromised accounts after discovering the abuse on May 31, 2026 and disabled the tool. Meta has not disclosed whether attackers accessed personal data. Several high-profile accounts compromised in the campaign were later offered for sale on underground marketplaces. A separate weakness in Instagram’s web-based password reset flow exposed unredacted email addresses and phone numbers when a username was submitted, a flaw that may have facilitated some takeovers.

Google released its June Android security update that fixes 124 vulnerabilities, including CVE-2025-48595, a Framework privilege escalation bug with a CVSS score of 8.4 that does not require user interaction. Google acknowledged there are indications of limited, targeted exploitation. The flaw affects devices running Android 14, 15, 16 and 16 QPR2. Google provided patches but did not identify targets or actors linked to the activity.

Microsoft’s GitHub organizations were affected by a self-replicating worm named Miasma. The incident impacted 73 repositories across the Azure, Azure-Samples, Microsoft and MicrosoftDocs organizations. GitHub restricted access to the affected projects while teams investigate and remediate. Security researchers trace Miasma to a public release of Mini Shai-Hulud code by a group called TeamPCP in mid-May 2026; Miasma is a variant that replicated through repositories and supply-chain assets.

Other supply-chain incidents surfaced in recent weeks. A certified Windows installer for Hola Browser was found to include an XMRig cryptocurrency miner after an update distribution pipeline was compromised. Multiple malicious packages were published to npm and PyPI, including trojanized copies of common libraries that include post-install hooks to fetch remote payloads, two npm packages that delivered an Epsilon Stealer, and a malicious package that exfiltrated data to Telegram while leaking its own bot token. A PyPI typosquat named Parsimonius contained a Telegram-based backdoor and had thousands of downloads before removal.

Observed tactics include abuse of automated support features and account recovery flows to obtain account control, use of repository access and automation to spread self-replicating code in developer ecosystems, and exploitation of a no-interaction Android privilege escalation vulnerability that can run covertly on vulnerable devices.

Investigations remain active. Meta is continuing its review of affected Instagram accounts and mitigation steps. Google released patches for impacted Android versions and advised device makers and users to apply updates. GitHub and Microsoft limited access to infected repositories and are working to remove malicious content and restore services.

Timeline details: the Instagram exploit was discovered on May 31, TeamPCP publicly released Mini Shai-Hulud code in mid-May, and Google issued its June security update addressing CVE-2025-48595. Security teams and developers are advised to apply available patches, revoke exposed credentials, and audit repository contents and package dependencies.