Cryptojacking, home-network intrusion, stalkerware, and identity theft recovery

[lizTheDeveloper]

Adds detection and remediation for a household whose Wi-Fi has been broken into, the cryptojacking that tends to arrive with it, and the identity theft that follows.

What was missing

Existing coverage was crypto_miner_detect (macOS only), wifi_security_audit (macOS only), mvt_spyware_scan (mobile backups), keylogger_indicators, and four small bloatware lists. The gaps:

• Nothing looked at the network itself — no way to see who is on the Wi-Fi, no interception detection, no router audit.
• Miner persistence was not checked anywhere. Killing a miner does nothing if a launch agent restarts it, which is the normal arrangement.
• No Windows miner detection at all, and no in-browser mining detection (which never appears in a process list — the process is Chrome).
• No stalkerware module, and no distinction between covert monitoring, workplace monitoring, and dual-use remote access.
• No identity theft walkthrough, which is where most of this ends up.

Seven new modules

Module	Platforms	What it finds
lan_device_inventory	all	Devices visible on the network, with OUI vendor labels
arp_spoof_check	all	Traffic interception: gateway impersonation, duplicate MACs, multiple default routes
router_security_audit	all	Gateway's exposed admin surface (telnet, TR-069, HTTP admin), UPnP
crypto_miner_persistence	all	What restarts a miner: launch items, cron, systemd, Run keys, scheduled tasks, shell profiles, dropped configs
win_crypto_miner_detect	Windows	Live miners by command line, established pool connections, high CPU
browser_cryptojacking_check	all	Mining extensions, startup pages, hosts-file entries
stalkerware_scan	all	Monitoring software, split by category

Two new profiles and guides

home_network_intrusion — six phases, ordered network → devices → accounts, because a cleaned laptop rejoining a compromised network is compromised again.

identity_theft_recovery — seven phases that double as a persistent checklist (rescue guide identity_theft_recovery, then --complete <n>). Ordered freeze → report → dispute: a dispute letter without an FTC identity theft report gets a form-letter reply; with one, §605B forces removal in four business days instead of a contestable 30-day investigation. US-first, with UK, Canada, Australia, and EU equivalents.

Both guides end with a resources and tiplines phase: free case-managed help (Identity Theft Resource Center, AARP helpline, DOJ elder fraud hotline, IDCARE, Access Now), official reporting channels, all six credit bureaus and databases accepting freezes, abuse-specific support including coerced debt, free legal aid, and per-country equivalents. Each opens with the warning that support numbers in search results are bought by scam call centres — worthless below the list, so it is step 1, and a test keeps it there.

Design decisions worth reviewing

• Every fix() is guidance only (ActionKind.GUIDANCE), nothing is auto-removed. On a possibly-compromised machine, deletion destroys evidence, and a half-removed miner is worse than an intact one. This follows the roadmap's P0 item 6 on not rendering guidance as a completed fix.
• stalkerware_scan leads with safety, not removal. If the person who installed it lives with the victim, cutting access tells them they have been found out. The first action is the abuse helplines, with a note not to look them up from the monitored device.
• Confidence is graded and carried in finding data. A wallet address or stratum URL is high confidence; a product name alone is medium; high CPU is a low-confidence lead with wording that says so.
• Detection states its limits. The device list says a quiet device can be missing; the spoof check says it cannot see interception at the router itself; both name mesh nodes and extenders as innocent explanations.
• Bounded work throughout, per the roadmap's P0 item 7: every subprocess call has a timeout, every filesystem scan has a file-count and byte cap, and no check traverses a home directory freely.
• Short product names match on word boundaries, so "bark" (a parental-control product) does not fire on barkeeper.app.
• Hosts-file blackholes are recognised as protection, not as a threat — a mining domain pointed at 0.0.0.0 is somebody defending the machine.

Supporting changes

• Shared cryptojacking IOC dataset and a shared neighbour-table helper, both data-only packages that module discovery skips.
• rescue.runtime.load_content_module() so modules can share a helper by path — works in a source checkout, a pip install, and a frozen bundle alike, where a plain import does not.
• Expanded known-bloatware datasets: adware, scareware, bundled miners, OEM trials. process_scanner now treats cryptominer as a critical category.
• Regenerated integrity_manifest.json for the runtime.py change, which was otherwise printing a tamper warning on every launch.

Unrelated pre-existing fixes

Three Python 3.12-only f-strings made win_malware_indicators and win_bsod_analysis fail to load entirely on the declared minimum Python 3.11, and test_module_win_scheduled_tasks_security fail to collect. Fixed, since one of them is a malware module directly relevant here. Happy to split these into their own PR.

Testing

86 new tests. Full suite: 3139 passed, 61 failed — all 61 verified to fail identically on a clean worktree of the base branch (macOS-specific tests running on Linux as root, a missing GPG key). test_module_ai_threat_indicators still hangs, as docs/ROADMAP.md already records.

Known gaps

• wifi_security_audit is still macOS-only, so there is no Wi-Fi encryption or WPS check for Windows or Linux.
• Phone numbers and URLs in the guides go stale. They are marked as accurate at time of writing with an instruction to verify at the official site, but they will need periodic review — the content-update mechanism in the roadmap is the natural home for that.