Miasma Phantom Gyp - Runner Process Memory Scraping for GitHub Actions Secrets

Leonardo Gasparini@Leonardo.Gasparini

•updated Jun 4, 2026•0•0•9

Detects attempts to read Runner.Worker process memory to extract GitHub Actions secrets in their unmasked form. The Miasma worm uses sudo python3 to escalate privileges and read /proc/<PID>/mem, then pipes through grep to extract secret values.