Yuta/Glove Stealer HTTPS Credential Exfil to Discord or Telegram

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.