Glove Stealer Python Process Accessing Chrome Credential Stores

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects Python interpreters (or processes executing from PyInstaller-generated temporary directories) accessing sensitive web browser files such as Login Data, Cookies, or Local State. This activity is commonly associated with information stealer malware, such as Glove Stealer, attempting to extract saved credentials from browsers.