Miasma/MYRA Infostealer Harvesting Crypto Wallet Vault Files via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects Node.js processes accessing paths associated with cryptocurrency wallets and browser extension storage (MetaMask, Phantom, Exodus, Electrum). This behavior is characteristic of infostealer malware attempting to exfiltrate seed phrases, keys, or wallet configuration data.