node.exe Reading MetaMask/Phantom Crypto Wallet Vault Files (Miasma/MYRA)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.