SSH Private Key Exfiltration by Python/Node with Outbound C2 within 60s (Contagious Interview)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.