Miasma Campaign - Marker Strings and Injected Payload Files Detected

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.