Yuta/Glove Stealer Discord and Electron App Token Theft from LevelDB

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized processes attempting to read LevelDB or credential storage files belonging to common Electron-based applications (Discord, Signal, Slack, Teams, Telegram). This behavior is characteristic of info-stealer malware like Yuta or Glove Stealer that target browser and application-based session tokens.