Glove Stealer Chrome App-Bound Encryption Bypass - Credential File Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects when processes other than legitimate browser-related binaries access Google Chrome's 'Login Data' or 'Local State' files. These files contain sensitive browser data, including stored credentials, and unauthorized access is a common indicator of credential theft or dumping attempts by malicious software.