Yuta/Glove Stealer PyInstaller Runtime Unpacked from _MEI Temp Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the execution of a PyInstaller-compiled payload associated with the Yuta/Glove Stealer campaign. The rule monitors for processes launching from temporary _MEI* extraction directories within %APPDATA% or %TEMP%, and specifically identifies the winupdate.exe payload within .cache subdirectories.