Miasma Fake 'Run Copilot' GitHub Actions Workflow for Secrets Exfiltration

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.