MYRA npm Infostealer Systemd User Service Masquerading as System Daemon

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•1

Detects the MYRA RAT (Operation Friday Harvest) establishing persistence by creating systemd user services disguised as legitimate system daemons (colord, haveged) under ~/.config/systemd/user/, enabling the service via systemctl --user enable, and dropping binaries to ~/.local/bin/. Also covers related persistence artifacts including /usr/local/lib/.libcache.so and /etc/profile.d/.sh.local. The rule also identifies node or node.exe spawning systemctl with the --user flag.