Miasma Infostealer: Node.js Accessing Browser Credential and Cookie SQLite Files

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.