Lazarus Contagious Interview: SSH Private Key Exfiltration from Developer Workstation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects processes attempting to read or open sensitive SSH files (keys and configuration) that are not recognized as legitimate SSH-related utilities (e.g., ssh, sshd, rsync, git). This behavior is often indicative of credential harvesting or unauthorized reconnaissance of authentication artifacts.