Miasma/npm Infostealer: node.exe Accessing Browser Credential Stores

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.