Miasma Worm CI/CD Secret Exfiltration from GitHub Actions Runner

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•4

Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.