Miasma Phantom Gyp - GitHub API Exfiltration and C2 Communication

Leonardo Gasparini@Leonardo.Gasparini

•updated Jun 4, 2026•0•0•9

Detects network connections from Bun or Node.js processes to GitHub API endpoints used by the Miasma worm for credential exfiltration. The malware creates repos under the liuende501 account and uploads encrypted stolen credentials.