Miasma/MYRA Infostealer SSH Key and AWS Credential Harvest on Developer Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.