InvisibleFerret SSH Key Theft: Script Process Read then Outbound Connection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.