Polymarket Trap Miasma/MYRA Infostealer SSH Key Harvesting via node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•8

Detects node.exe accessing sensitive SSH configuration and key files (id_rsa, id_ed25519, id_ecdsa, known_hosts, authorized_keys) within the user's .ssh directory. This behavior is associated with the Miasma and MYRA infostealers identified in the Polymarket Trap npm supply chain attack campaign, which exfiltrate developer credentials.