OpenClaw - Browser Extension Extraction (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•6

This rule detects Python or Node.js processes aggressively accessing directories associated with cryptocurrency wallet browser extensions like MetaMask, Phantom, and Binance Chain. This activity is indicative of information stealer malware attempting to exfiltrate sensitive wallet data.