REVSTEALER leaves four modules behind — one disables Windows Update and Defender to make room for a miner

On September 2, Elastic Security Labs published a report and a technical paper on REVSTEALER — a commercial Windows infostealer that has been on sale since at least February 2026. What's most interesting isn't the stealer's own capabilities but four previously undocumented programs uncovered in the course of the same investigation: ProManager, WinUpdate, SoftManager, and LockAppHost.

REVSTEALER itself works on a “fire and forget” basis: it siphons off browser passwords and cookies, crypto wallets, gaming and messenger accounts, and files, reports back to the server when it's done, and deletes itself, leaving no persistence behind. The four new modules are built differently — each writes itself into the user profile and stays there for the long haul.

What the modules do

ProManager steals wallet files and browser extensions, draws an attacker-controlled interface over the wallet window (most desktop wallets are written in Electron), and logs everything typed or pasted into password and seed-phrase fields.

WinUpdate watches the clipboard, swaps copied crypto addresses for the attacker's, and fishes out text that looks like a wallet recovery phrase.

SoftManager turns the machine into a reverse proxy, routing the attacker's traffic through the victim's connection.

LockAppHost is the most destructive. To gain administrator rights it abuses the built-in CMSTP utility, and if that fails it displays an ordinary elevation prompt. It then adds exclusions to Microsoft Defender, disables five Windows Update services, 11 scheduled update tasks, and two malware-removal tasks, after which it hides a miner inside legitimate processes such as nslookup.exe or svchost.exe. The weakening of the defenses it introduces persists even after the miner is found.

Links and distribution

Elastic never observed the modules being delivered to a live infected host, so the connection rests not on an intercepted transfer but on shared code: the same packer, identical runtime function resolution, and the use of Polygon smart contracts for backup configuration (the EtherHiding technique, which is resistant to takedowns).

The stealer itself is heavily protected against analysis: it checks the system against ten sandbox indicators, bails out under ten languages common in Russia and Central Asia, evades security-software hooks via indirect system calls, and requires a six-digit code to be entered before it runs. To bypass App-Bound Encryption in Chrome it launches the browser under a debugger and reads the key from memory — a trick borrowed from the ElevationKatz project.

REVSTEALER spreads mainly through lures involving game cheats (Elastic found at least 17 YouTube channels, many of them hijacked from their previous owners) and under the guise of pirated software — including a fake “Claude Opus 5 Free Desktop” app that copies Anthropic's branding. There's no sign that Anthropic itself was compromised. Over the past year, Elastic's rule matched roughly 4,700 samples on VirusTotal.

A separate problem: public YARA rules cover the stealer's core and three of the modules, but not LockAppHost. Because the stealer deletes itself, an infection can look finished while the modules keep running. Responders are advised to restore the disabled Windows Update services and tasks, remove the added Defender exclusions, and look for the miner in suspended processes. Victims should change passwords and terminate active sessions — a password reset alone isn't enough, since the session cookies have been stolen too.

Source: The Hacker News