BeaverTail: node.exe/python.exe Reading Browser Credential Stores with Outbound C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.