Deno Runtime Accessing Browser and Wallet Data

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•1•0•3

This rule detects the Deno runtime accessing sensitive browser profile data (Login Data, Cookies, Local State) and cryptocurrency wallet directories (Wallet, Electrum, Exodus, MetaMask) on the same machine. This dual access pattern is indicative of infostealer malware, often distributed as fake coding utilities. End-user PCs should rarely run Deno, making such activity highly suspicious.