Polymarket Trap: Crypto Wallet Vault Multi-Path Access by Non-Browser Process
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
CQL
