Yuta/Glove Stealer Discord and Messaging App Token Theft from LevelDB

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects unauthorized processes, such as PyInstaller binaries or Python scripts, attempting to read LevelDB storage files used by popular messaging applications (Discord, Telegram, Signal, Slack, and Microsoft Teams) for session and authentication token extraction, a technique commonly associated with information stealers like Yuta or Glove Stealer.