Glove Stealer Chrome ABE Bypass via Suspended chrome.exe Spawned by Python
Detects anomalous execution of chrome.exe as a child process of Python interpreters or PyInstaller-compiled binaries running from non-standard, user-writable directories. This pattern is indicative of the Glove Stealer malware attempting to perform a Chrome App-Bound Encryption (ABE) bypass by injecting a decryption helper DLL into a suspended chrome.exe process to exfiltrate master keys.
Sigma
