Miasma Persistence via Profile

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•2

Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.