Miasma/MYRA Infostealer SSH Private Key Collection via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects when a Node.js process accesses sensitive files associated with SSH configurations, private keys, or package manager credentials (such as .npmrc or .pypirc). Such behavior is highly unusual for legitimate web application processes and may indicate an attacker attempting to steal credentials or secrets from a compromised system.