Glove Stealer AMSI/ETW In-Memory Patch via Python/PyInstaller Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.