Miasma Phantom Gyp - IMDS and Cloud Credential Harvesting

Leonardo Gasparini@Leonardo.Gasparini

•updated Jun 4, 2026•0•0•8

Detects Bun or Node.js processes spawned from temporary directories making requests to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm harvests cloud credentials from CI runners via these endpoints.