Polymarket Trap Miasma/MYRA C2 DNS Exfil from Node/npm with Credential Read Enrichment

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.