Miasma/MYRA: node.exe Accessing Crypto Wallet Extension Storage (Polymarket Trap)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.