OtterCookie ldata credential stealer component invoked by parser.js

Ankit Mehta@Secvyn

•updated Sep 4, 2026•0•0•2

This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.