Security researchers found a new Windows information stealer called REVSTEALER. It's been sold as commercial malware since at least February 2026. The stealer itself is designed to delete itself after it runs. But it leaves behind four persistent modules that keep doing damage long after the main malware is gone.

Elastic Security Labs documented the four programs. They named them ProManager, WinUpdate, SoftManager, and LockAppHost. Each one does something different. And one of them is particularly nasty, it disables Windows Update and Microsoft Defender before running a cryptocurrency miner.

The core REVSTEALER steals browser passwords, cookies, crypto wallets, gaming accounts, messaging data, and files. It reports "complete" to its server, deletes itself, and leaves no trace. No persistence. No leftovers. Just gone.

But those four modules? They install themselves into the user's profile and stay there. They're separate executables, not plug-ins loaded into the stealer itself. And they share the same build tradecraft as REVSTEALER, including the same packer and runtime function resolution.

Let me break down what each one does.

Quick Summary

The Core Stealer

Before the modules even arrive, REVSTEALER casts a wide net. It collects:

• Browser passwords and cookies
• Files from more than 50 cryptocurrency wallets
• Session data from Telegram and other messaging clients
• VPN and FTP configuration
• Windows Credential Manager data
• Password manager data
• Selected documents

Gaming Accounts:

For some gaming platforms, it goes further. It decrypts the stored Roblox session cookie, allowing an attacker to take over the account without the password.

Chrome App-Bound Encryption Bypass:

To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. This isn't a new technique, but it's effective. Elastic said it was likely adapted from the public ElevationKatz project. Gen Digital described it as the first infostealer seen using the technique in the wild when they analyzed VoidStealer in March 2026.

The Four Modules

ProManager: Wallet and Password Stealer

ProManager steals wallet files and browser wallet extensions. But it does something more clever. It displays attacker-controlled content over a wallet application's window.

How It Works:

Most desktop cryptocurrency wallets are built with the Electron framework. ProManager reads the wallet window's saved position and opens attacker-supplied content sized and positioned to overlay the real wallet. It doesn't touch the wallet program itself.

Password Logging:

A separate part of the module records what the user types into password and passphrase fields, including values pasted from the clipboard.

Persistence:

Registry Run key.

C2 Domain: config.hubdisplay[.]lol

WinUpdate: Clipboard Hijacker

WinUpdate watches the clipboard. When it sees a cryptocurrency address, it replaces it with the attacker's address. It also collects text that looks like a wallet recovery phrase.

How It Works:

Bitcoin address is copied to send money. The malware replaces it with the attacker's address. You paste and send, and your money goes to the attacker.

Persistence:

Scheduled task, with a Registry Run key as fallback.

C2 Domain: health.journal-metric[.]lol

SoftManager: Reverse Proxy

SoftManager turns the machine into a reverse proxy. It reroutes the network traffic of the attacker using the connection of the victim.

What That Means:

This means that the attacker's activities are rendered invisible because they happen under the IP address of the victim and any such malicious traffic is perceived to be coming from the victim.

Persistence:

Logon script, scheduled task, or Registry Run key.

C2 Domain: metric.gardenpark[.]click

LockAppHost: Crypto Miner

LockAppHost is the most disruptive of the four. It starts a cryptocurrency miner with administrative privileges after stopping the Windows Update and Microsoft Defender features.

Operation:

• Uses the Windows CMSTP tool to obtain administrator privileges
• If that fails, reverts to the standard elevation prompt
• Creates Microsoft Defender exclusions for common directories and files
• Disables 5 Windows Update services
• Disables 11 update tasks and 2 malware removal tasks
• Hides a miner inside legitimate Windows processes

The Problem:

The changes it makes to weaken the machine's defenses remain after the miner is found. Even if you remove the miner, Windows Update is still disabled and Defender exclusions are still in place.

Persistence:

Registry run key or Service.

SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5

Spread Mechanisms of REVSTEALER

Game Cheat Lures:

The majority of infections from REVSTEALER are achieved through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked from their original owners, that promoted two cheat websites using short AI-generated videos.

Pirated Software:

The malware has also been packaged as pirated or impersonated software. Morphisec documented a fake "Claude Opus 5 Free Desktop" application that copied Anthropic's branding.

The Numbers:

Elastic's detection rule matched about 4,700 samples on VirusTotal over the past year. That's a count of files, not confirmed infections.

Built to Resist Analysis

REVSTEALER is designed to make analysis difficult.

Sandbox Checks:

It scores the machine against 10 sandbox checks and stops if the total is too high.

Language Checks:

It terminates on systems set to one of 10 languages used across Russia and Central Asia.

API Obfuscation:

It does not resolve the functions of Windows through the regular import table and invokes the kernel through indirect system calls in order to evade the hooks used by the security programs.

EtherHiding:

In case the primary server that contains commands for it is inaccessible, it fetches the IP address from a smart contract residing in the Polygon blockchain. This technique is called EtherHiding and is very difficult to take down.

Verification Gate:

The unpacked versions display a verification window that requires a six-digit random code before execution. This is a gate against automated analysis.

What to Look For

Indicators of Compromise:

SHA-256 Hashes:

• adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4 (REVSTEALER)
• 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa (ProManager)
• 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb (WinUpdate)
• 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2 (SoftManager)
• c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5 (LockAppHost)

Domains:

• monitor5.roast-core85[.]click (REVSTEALER C2)
• config.hubdisplay[.]lol (ProManager C2)
• health.journal-metric[.]lol (WinUpdate C2)
• metric.gardenpark[.]click (SoftManager C2)

What to Do if You Are Infected?

1. Identify Persistent Modules

ProManager, WinUpdate, SoftManager, and LockAppHost in the user profile can be checked for.

2. Enable Windows Update Again

LockAppHost disables Windows Update services and tasks. Re-enable them.

3. Delete Microsoft Defender Exceptions

LockAppHost creates exceptions for standard directories. These should be removed.

4. Identify Hidden Miners

A miner is usually found in the suspended process of nslookup.exe or svchost.exe.

5. Reset Passwords and Log Out

Stealer steals session cookies and the Chrome App-Bound Encryption key. Changing passwords is not enough. Log out of your accounts.

6. Check Your Installed Softwares

Look for fake or pirate Softwares, including "free" AI tools and game cheats.

The Bottom Line

REVSTEALER is a commercial information stealer that deletes itself after running. But it leaves behind four persistent modules that keep doing damage. One of them disables Windows Update and Microsoft Defender before running a crypto miner.

What You Need to Know:

What You Need to Do:

• Check for the four persistent modules
• Re-enable Windows Update if disabled
• Remove Defender exclusions
• Check for hidden miners
• Change passwords and end sessions

FAQ Section

What is REVSTEALER?

Windows based info stealer that is marketed as commercial malware from February 2026. It has capabilities to gain control of the browser, cryptocurrency wallet, gaming login credentials and file data.

Which are the four modules that are persistent?

ProManager (Wallet Stealer), WinUpdate (Clipboard Hijacker), SoftManager (Reverse Proxy), and LockAppHost (Cryptocurrency Miner).

What does LockAppHost do?

It stops the Windows Update and Microsoft Defender services and launches a cryptocurrency miner as an administrator.

How Does REVSTEALER Spread?

Primarily through game-cheat lures via YouTube and pirated software. There are at least 17 YouTube channels that were compromised to promote cheat sites.

What should I do if I'm infected?

Check for the four modules, re-enable Windows Update, remove Defender exclusions, check for hidden miners, change passwords, and end active sessions.

Source: The Hacker News