Miasma/MYRA infostealer accessing MetaMask/Phantom crypto wallet vaults

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects when a Node.js process accesses sensitive files associated with cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet) or browser extension storage directories. This behavior is highly indicative of information-stealing malware attempting to extract private keys, wallet configuration files, or sensitive browser session data.