REVSTEALER is a commercial Windows infostealer sold since at least February 2026 that exfiltrates browser passwords, cookies, cryptocurrency wallets, gaming accounts, messaging data, and VPN credentials before deleting itself. Elastic Security Labs now reports four previously undocumented programs associated with the malware — named ProManager, WinUpdate, SoftManager, and LockAppHost — that install themselves into the user profile and stay there after the core stealer is gone. Each connects to its own command-and-control domain, and all share REVSTEALER’s build tradecraft including the same packer, runtime function resolution, and a Polygon blockchain fallback (the EtherHiding technique) for reaching their servers when the primary domain is blocked.
The most aggressive of the four, LockAppHost, uses the Windows CMSTP tool to gain administrator rights without triggering a standard elevation prompt. Once elevated, it adds Microsoft Defender exclusions across common folders and file types, disables five Windows Update services, disables eleven scheduled update and two malware-removal tasks, and then hides a cryptocurrency miner inside a suspended instance of nslookup.exe or svchost.exe. The defensive changes it makes outlast the miner — an infected machine remains weakened even after the miner is removed. ProManager targets cryptocurrency wallet users: it reads a desktop wallet’s saved window position and opens attacker-controlled content sized to overlay the wallet exactly, while a separate component logs keystrokes and clipboard pastes from password fields. REVSTEALER itself takes the Chrome App-Bound Encryption key by launching the browser in a debugger, decrypts Roblox session cookies, and checks ten sandbox signals before running — stopping entirely if the score is too high, or if the system language is one of ten used across Russia and Central Asia. The malware spreads mainly through AI-generated YouTube cheat videos on hijacked channels and through fake software installers, including a fake “Claude Opus 5 Free Desktop” application documented by Morphisec on 31 August 2026.
How to check if you’re affected
Affected devices are any Windows computers used to download game cheats, pirated software, or unofficial installers for AI tools from unofficial sources. If you suspect infection, look for a cryptocurrency miner hidden inside a suspended nslookup.exe or svchost.exe process. Check whether Windows Update services have been disabled and whether Microsoft Defender has unexpected folder exclusions added. Because REVSTEALER captures session cookies in addition to passwords, a password change alone is not enough — end all active sessions on banking, email, and cryptocurrency accounts and regenerate API keys and tokens.
Sources
- Elastic Security Labs: REVSTEALER credential harvesting and post-infection modules
- Morphisec: REVSTEALER — Silence Is Its Greatest Weapon (31 Aug 2026)
- The Hacker News coverage