Miasma/MYRA node.js process reading crypto wallet extension storage dirs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•1

Detects instances where a node.exe process accesses files located within directories associated with popular browser-based cryptocurrency wallets. This pattern is commonly observed in infostealer malware campaigns that target wallet seeds, keys, and browser credentials stored in extension local storage or browser profile paths.