Miasma Phantom Gyp - AI Assistant Backdoor File Creation

Leonardo Gasparini@Leonardo.Gasparini

•updated Jun 4, 2026•0•0•12

Detects creation of AI coding assistant configuration files used by the Miasma worm for persistence. The malware injects setup scripts into .claude, .cursor, .gemini, and .vscode directories that execute via Bun on IDE open.