Crypto Wallet Data Harvesting by npm/Temp-Path Process (T1555.003)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.