Glove Stealer Chrome ABE Bypass - Non-Chrome Access to elevation_service.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.