Polymarket Trap: node.exe Harvesting Crypto Wallet Vault Files from Browser Extension Storage
Detects unauthorized file read activity by node.exe targeting browser-based crypto wallet vault files, specifically 'Local Extension Settings'. This behavior is consistent with infostealer malware (such as Miasma/MYRA) using malicious JavaScript payloads to harvest sensitive encrypted vault data from developer environments.
YARA-L
