Environment Variable Exfiltration via Curl

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•5

Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.