Miasma 'Run Copilot' Weaponized GitHub Actions Workflow CI/CD Secret Exfil

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•3

Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.