Miasma Infostealer: Password Manager DB Theft via node.exe (Polymarket Trap)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects node.exe (often associated with malicious npm package runtimes) accessing local credential store files such as KeePass, 1Password, and Bitwarden. This activity is indicative of infostealer payloads (e.g., Miasma/MYRA) targeting developer workstations to exfiltrate sensitive credential databases.