MYRA RAT Cron and Shell Profile Persistence via npm node Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects persistence mechanisms associated with the MYRA RAT. This includes Linux/macOS crontab modification using specific schedules or shell profile writes initiated by node/npm processes, as well as Windows scheduled task creation or task manipulation via schtasks.exe initiated by node/npm processes.