SSH private key theft via .ssh directory scan for PRIVATE KEY content

Ethan Andrews@eandrews

•updated Jul 24, 2026•12•0•7

Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.