Operation Friday Harvest npm Infostealer Cloud Credential File Access

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects unauthorized access to cloud provider credential files (AWS, GCP, Azure) by potentially suspicious processes. It specifically monitors processes such as node.exe, npm, python, bash, or binaries running from temporary directories (/tmp, %TEMP%) while excluding legitimate CLI tools.