# REVSTEALER Malware Disables Windows Defenses to Mine Cryptocurrency Four stealthy modules persist after the infostealer self-destructs, targeting wallets and system resources - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-06 - **Original article:** - **On Brifing:** https://brifing.si/s/de6a8836-d8db-421e-91da-1336725c6618 ## The REVSTEALER malware ecosystem Elastic Security Labs uncovered four persistent modules linked to the REVSTEALER Windows infostealer. These components - ProManager, WinUpdate, SoftManager and LockAppHost - remain active after the main malware self-deletes. REVSTEALER has been commercially available since February 2026, stealing browser data, cryptocurrency wallets, gaming accounts and messaging sessions. The malware uses sophisticated techniques including Polygon blockchain smart contracts for backup configuration and indirect system calls to evade detection. ## LockAppHost's destructive capabilities The most dangerous module, LockAppHost, escalates privileges by abusing Windows' CMSTP tool. Once elevated, it disables 5 Windows Update services and 11 scheduled tasks, adds Microsoft Defender exclusions, then hides a cryptocurrency miner within legitimate processes like svchost.exe. These changes persist even after miner detection. Elastic notes the module specifically targets common folders and file types for exclusion, weakening the system's defenses long-term. The modifications require manual reversal by security responders. ## ProManager's wallet targeting scheme ProManager specializes in stealing from Electron-based cryptocurrency wallets by overlaying fake interfaces. It reads the wallet window's position data to perfectly align malicious content over the real application without modifying it. A separate component logs all keyboard input and clipboard pastes into password fields. This technique allows theft without direct wallet compromise. Elastic's analysis shows the module specifically targets over 50 known wallet applications and browser extensions. ## Advanced evasion techniques REVSTEALER employs multiple anti-analysis measures: it scores systems against 10 sandbox checks, terminates on Russian/Central Asian language settings, and uses indirect kernel calls to bypass security hooks. The malware retrieves backup C2 addresses from Polygon blockchain smart contracts via a technique called EtherHiding. Unpacked versions include a 6-character verification gate similar to Lumma Stealer. These methods make both static and dynamic analysis challenging for researchers. ## Distribution through compromised channels The malware primarily spreads through hijacked YouTube channels promoting game cheat sites via AI-generated videos. At least 17 compromised channels were identified pushing two cheat domains. REVSTEALER also disguises itself as pirated software, including a fake 'Claude Opus 5' desktop app copying Anthropic's branding. Elastic matched 4,700 VirusTotal samples over the past year, though this represents files rather than confirmed infections. ## Chrome credential extraction REVSTEALER bypasses Chrome's App-Bound Encryption by launching the browser in debug mode to extract decryption keys from memory. This technique, adapted from the public ElevationKatz project, was first seen in the wild with VoidStealer in March 2026. The stealer also decrypts Roblox session cookies for account takeover. Elastic warns that password resets alone are insufficient - users must terminate all active sessions as the malware steals session tokens. ## Detection challenges Because REVSTEALER deletes itself after initial theft, infections may appear resolved while modules continue operating. Elastic has published YARA rules covering the core stealer and three modules, but lacks detection for LockAppHost. The company notes shared code patterns suggest the components were built by the same group. Responders must manually check for disabled services, Defender exclusions, and hidden miners in system processes. ## Security recommendations Elastic advises avoiding pirated AI tools and game cheats, especially those promoted via suspicious YouTube channels. For protection against similar threats, they recommend: 1) Only installing software from official sources 2) Monitoring for unexpected system changes 3) Checking for suspended processes like nslookup.exe 4) Rotating all credentials after exposure 5) Reviewing Microsoft Defender exclusions. The company has released behavioral detection rules and indicators of compromise. ## Sources covering this story - https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._