Non-Browser Process Enumerating MetaMask Extension Directory

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects instances where a process that is not a recognized web browser accesses or enumerates the file storage path of the MetaMask browser extension. This behavior is indicative of unauthorized reconnaissance or credential theft attempt targeting cryptocurrency wallet data stored locally, often performed by malware following successful system compromise.