InvisibleFerret Searches Cryptocurrency Wallet Directories

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').