REVSTEALER Modules Disable Defenses, Deploy Miner, Steal Data

Elastic Security Labs has identified four previously undocumented modules associated with REVSTEALER, an emerging Windows information stealer. These modules persist on infected systems even after the core stealer self-deletes, significantly escalating the threat by disabling critical Windows security features and deploying cryptocurrency miners. The findings, detailed by The Hacker News, highlight a sophisticated evolution in REVSTEALER’s attack chain, which has been active since at least February 2026.

Technical Analysis of REVSTEALER and Its Modules

REVSTEALER Core Functionality

The primary REVSTEALER component operates by exfiltrating a wide array of sensitive information. This includes browser passwords and cookies, data from over 50 cryptocurrency wallets (both desktop and browser extensions), session data from messaging clients like Telegram, VPN and FTP configurations, Windows Credential Manager entries, password manager data, and selected documents. For gaming platforms such as Roblox, the stealer goes further by decrypting stored session cookies to enable account takeover without needing the password. Notably, REVSTEALER employs a technique to bypass Chrome’s App-Bound Encryption by launching the browser in a debugger and extracting decryption keys from memory, a method also observed in VoidStealer and adapted from the public ElevationKatz project. Once its data collection is complete, the core stealer reports ‘complete’ to its command server and deletes itself, leaving no direct persistence.

Associated Modules: ProManager, WinUpdate, SoftManager, LockAppHost

Unlike the ephemeral core stealer, the newly discovered modules—ProManager, WinUpdate, SoftManager, and LockAppHost—are designed for persistence. Each module installs itself into the user’s profile and remains active. While all four share REVSTEALER’s build tradecraft, including common packing techniques, runtime function resolution, and the use of Polygon smart contracts for backup configuration, their specific functions vary:

• LockAppHost: This is the most disruptive module. It achieves administrator privileges by abusing the Windows CMSTP tool, with a fallback to a standard elevation prompt. Once elevated, LockAppHost adds Microsoft Defender exclusions for common folders and file types, effectively demonstrating how REVSTEALER bypasses Windows Defender protections. It also disables five Windows Update services, eleven scheduled update tasks, and two malware removal tasks, significantly weakening the system’s defenses. Post-disruption, it hides a cryptocurrency miner within legitimate Windows processes like nslookup.exe or svchost.exe.
• ProManager: This module specifically targets users of desktop cryptocurrency wallets, many of which are built with the Electron framework. ProManager reads the wallet window’s saved position and overlays the legitimate wallet interface with attacker-supplied content. A separate component within this module records user keystrokes and clipboard data entered into password and passphrase fields.
• WinUpdate and SoftManager: The source material indicates these are associated programs but does not detail their specific functionalities beyond their presence as persistent components.

Distribution and Evasion Tactics

REVSTEALER primarily reaches victims through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked, promoting two cheat websites using AI-generated videos. The malware has also been distributed as pirated or impersonated software, such as a fake “Claude Opus 5 Free Desktop” application documented by Morphisec.

To evade analysis, REVSTEALER employs several sophisticated techniques:

• It performs ten sandbox checks, terminating execution if the total score is too high.
• It terminates on systems configured with one of ten languages used across Russia and Central Asia.
• It resolves Windows functions without a normal import table and utilizes indirect system calls to bypass security product hooks.
• For takedown resilience, if its main command server is unreachable, it retrieves a backup address from a smart contract on the Polygon blockchain, a method known as EtherHiding.
• Unpacked builds include a verification window requiring a random six-character code, a gate against automated analysis similar to Lumma Stealer and AuraStealer.

Recommendations and Mitigations

Defending against REVSTEALER requires a multi-layered approach, focusing on prevention, detection, and post-infection remediation. Security professionals should prioritize the following:

• User Education: Emphasize the risks of downloading unofficial software, especially “free” or pirated versions of paid tools and game cheats. Users should only obtain software from official, verified channels.
• Proactive Monitoring: Implement strong endpoint detection and response (EDR) solutions to monitor for suspicious process activity, unauthorized modifications to system services, and unusual network connections. Elastic has published YARA rules and behavioral rules, along with indicators for detection and blocking, as part of comprehensive REVSTEALER mitigation steps.
• Post-Infection Remediation for LockAppHost: If LockAppHost activity is detected or suspected, immediate steps are crucial. Responders must re-enable the five Windows Update services and eleven scheduled tasks that were turned off, remove any Microsoft Defender exclusions added by the module, and actively detect REVSTEALER crypto miner presence by examining suspended instances of nslookup.exe or svchost.exe for the hidden miner.
• Credential Reset: Due to the stealer’s ability to exfiltrate session cookies and App-Bound Encryption keys, affected users must immediately change all compromised passwords and terminate active sessions across all accounts, especially for banking, cryptocurrency, gaming, and messaging services.

Related: ClickLock macOS Malware: Password Theft via Forced Login Prompt, Microsoft Resolves Windows Update Failures with WUSA via Network Share