REVSTEALER Modules Undermine Defender

Elastic Security Labs is shedding light on the wider ecosystem surrounding REVSTEALER, an emerging Windows information stealer that first appeared in the wild earlier this year. In a report published September 2, the company documented four previously unreported programs linked to the stealer that act independently of it, persisting on infected machines even after the core malware deletes itself.

Among these modules is one that quietly takes over the clipboard to reroute cryptocurrency transactions, and another that disables Windows Update and Microsoft Defender before running a cryptocurrency miner. The findings, accompanied by a technical white paper, suggest that attackers are increasingly bundling their infostealer operations with follow-up payloads that extend access long after the initial breach.

The Self-Deleting Stealer

REVSTEALER has been sold as a commercial infostealer since at least February 2026, with the earliest sample detected on VirusTotal that month. Its core function is data theft: it exfiltrates browser passwords and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files. Once it reports a successful harvest to its command server, it deletes itself, leaving no trace of the initial compromise.

That self-destructing behavior makes detection difficult, but Elastic’s investigation reveals that REVSTEALER is often just the beginning. The four new modules—ProManager, WinUpdate, SoftManager, and LockAppHost—each install themselves into the user's profile and remain active, creating a persistent foothold that outlives the main stealer.

Elastic recovered the modules from the same investigation as REVSTEALER and found they share core build tradecraft, including the same packer, runtime function resolution, and use of Polygon smart contracts for backup configuration. The core stealer can also download and run additional executables, although Elastic did not observe any of the four being delivered onto a live host, so the connection is based on code and context rather than a direct hand-off.

Modules That Outlive the Stealer

The four programs are separate executables, not plug-ins loaded into the stealer, and each performs a distinct role.

ProManager targets desktop cryptocurrency wallets, many of which are built on the Electron framework. By reading a wallet window’s saved position, it can display attacker-controlled content that overlays the real interface, tricking users into entering sensitive information. It also logs passwords and passphrases typed or pasted into fields it identifies as security-related.

WinUpdate is a clipboard watcher that replaces copied cryptocurrency addresses with ones controlled by the attacker. It also scans for text resembling wallet recovery phrases, harvesting keys that grant full access to digital assets.

SoftManager converts the infected machine into a reverse proxy, routing the attacker’s network traffic through the victim’s connection to hide their activity.

LockAppHost is the most disruptive. It runs a cryptocurrency miner with administrator rights after disabling Windows Update and excluding folders from Microsoft Defender, weakening the system’s defenses.

LockAppHost: The Miner Module

LockAppHost is the most aggressive of the four modules. To gain administrator privileges, it abuses the Windows CMSTP tool, falling back to a standard elevation prompt if that fails. Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables five Windows Update services, disables 11 scheduled update tasks, and disables 2 malware removal tasks. It then hides a miner within legitimate Windows processes, such as nslookup.exe or svchost.exe.

Elastic notes that the changes LockAppHost makes to weaken the machine’s defenses persist even after the miner is discovered, meaning the system remains vulnerable unless responders explicitly undo them.

Broader Capabilities of REVSTEALER

Before the modules ever arrive, REVSTEALER casts a wide net. It collects browser passwords and cookies; files from more than 50 cryptocurrency wallets and a large set of browser extensions; session data from Telegram and other messaging clients; VPN and FTP configuration; the Windows Credential Manager; password managers; and selected documents.

For some gaming platforms, it goes a step further: it decrypts the stored Roblox session cookie, allowing an attacker to take over the account without knowing the password.

To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. Elastic said this technique was likely adapted from the public ElevationKatz project and was also used by another stealer, VoidStealer, in March 2026. Gen Digital, which analyzed VoidStealer, described it as the first infostealer seen using the technique in the wild.

How REVSTEALER Spreads

REVSTEALER reaches victims primarily through game-cheat lures. Elastic identified at least 17 YouTube channels, many hijacked from their original owners, that promoted two cheat websites using short AI-generated videos. The malware has also been packaged as pirated or impersonated software, including a fake “Claude Opus 5 Free Desktop” application, as documented by Morphisec on August 31.

The fake Claude app copied Anthropic’s branding, but Elastic found no indication that Anthropic itself was compromised. Elastic’s detection rule matched about 4,700 samples on VirusTotal over the past year, though that count is files rather than confirmed infections.

Evasion and Persistence

REVSTEALER is built to resist analysis. It scores the machine against 10 sandbox checks and stops if the total is too high, and it terminates on systems set to one of 10 languages used across Russia and Central Asia. It resolves Windows functions without a normal import table and calls the kernel via indirect system calls to bypass hooks installed by security products.

If its main command server is unreachable, it reads a backup address from a smart contract on the Polygon blockchain—a takedown-resistant method known as EtherHiding. Unpacked builds also show a verification window that asks for a random six-character code before running, a gate against automated analysis that Elastic compares to Lumma Stealer and AuraStealer.

Key Numbers from the Report

• 4 previously unreported modules linked to REVSTEALER
• 5 Windows Update services disabled by LockAppHost
• 11 scheduled update tasks and 2 malware removal tasks disabled
• More than 50 cryptocurrency wallets targeted
• 17 YouTube channels used as lures
• About 4,700 samples matched on VirusTotal

What This Means for Users

The persistence of these modules is a reminder that infostealer infections are rarely one-and-done events. Even after a stealer deletes itself, components like LockAppHost can leave machines crippled and exposed, with miner software hiding in plain sight. For businesses, the discovery of these modules should prompt a thorough review of any system that might have been compromised, with attention to Windows Update and Defender settings that may have been altered.

To reduce the risk of infection, Elastic advises avoiding “free” or unofficial versions of paid AI tools and game cheats, and installing Claude only from Anthropic’s official channels. Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions rather than assume a password reset is enough. The presence of such a coordinated set of modules suggests attackers are becoming more organized in their post-exploitation playbooks.