InvisibleFerret Clipboard Harvesting by python/node with Developer Parent and Credential File Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects scenarios where development tools such as VS Code (Code.exe) or npm spawn multiple child processes of Python or Node.js interpreters within a short time window, followed by those same interpreters accessing sensitive credential files (e.g., SSH keys, browser login data, or cloud configuration files). This pattern is indicative of a developer workstation compromise or a supply chain attack involving malicious code execution.