Glove Stealer Defender Disable and Exclusion Bypass via Python or PyInstaller Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.