SSH Private Key Theft via File Read by Non-SSH Scripting Processes

Duo Tech@duotech

•updated Jul 24, 2026•2•0•3

Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.