SSH/GPG Key Theft by npm/node or /tmp Process Followed by C2 Exfil

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•10

Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.