Trum3it: MetaMask/Phantom Vault File Access by Non-Browser Process (T1555)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects unauthorized access or modification attempts to cryptocurrency wallet files (specifically MetaMask and Phantom browser extensions) by non-browser processes. This behavior is indicative of credential theft or wallet exfiltration by malicious software.