ChainScript wallet_scan enumerating desktop/browser wallet paths via node.exe

Kaung Khant Ko@kaungkhantko

•updated Sep 21, 2026•0•0•3

Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.