Miasma/MYRA node.exe Reading Crypto Wallet Browser Extension Storage

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects instances of the 'node.exe' process accessing file system paths associated with common browser-based cryptocurrency wallet extensions (such as MetaMask, Phantom, Coinbase Wallet, etc.). This behavior is highly suspicious as it indicates a potential attempt to steal local wallet data or seed phrases.