Sapphire Sleet - Cryptowallet Extension Scraping

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•6

This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.