Miasma/MYRA: node.exe Reading Developer Credential Files (SSH, AWS, npm, Docker)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where a node.exe process accesses common configuration, credential, or authentication files. Adversaries may leverage Node.js scripts or malicious applications to exfiltrate sensitive data such as SSH keys, AWS credentials, Docker configurations, or git configurations.