Sckit Worm runtime-update.yml GitHub Actions Workflow Injection

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects the creation of a malicious GitHub Actions workflow file named 'runtime-update.yml', a known tactic used by the Sckit supply-chain worm. The worm injects this workflow to automate persistence and further propagation of the Go-based implant within CI/CD pipelines.