Node/Python Process Accessing Browser Credential Stores or Crypto Wallet Files

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•4

Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.