Malwarehigh
RevStealer spreads through 100+ domains and hijacked YouTube channels
Original title: RevStealer Uses 100+ Domains and Hijacked YouTube Channels to Spread Credential-Stealing Malware
AI summary · x-ai/grok-4.7Summaries by Vani AI
The stealer takes browser secrets, game accounts, and wallets, then deletes itself after sending the data.
Akatsuki Legion reported on November 9, 2026, that RevStealer is distributed through more than 100 related domains, hijacked YouTube channels, and fake AI tools aimed at gamers and people seeking free software. Downloads of game cheats, cracked apps, and trojanized tools start a multi-stage infection that steals passwords, cookies, game accounts, and crypto wallets. Elastic Security Labs and Morphisec have also tracked the malware. Operators appear financially motivated, and the report says the same channel can deliver XMRig or ransomware.
Unconfirmed: No nation-state link is confirmed, and not every linked domain is confirmed to distribute RevStealer.
Key facts
- Named hubs include elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com.
- Not every related domain is confirmed to spread RevStealer; one cluster looks tied to REMCOS.
- It quits at a sandbox score of seven or for Russian, Ukrainian, or Central Asian languages.
- If the main server is down, it reads a backup address from a Polygon smart contract.
- A LockAppHost module can run XMRig, and the operator can push ransomware.
Security assessment · AI, from the article
Impact: Steals passwords, cookies, game accounts, and crypto wallets
What to do
- 1.Watch for Defender exclusion changes and new executables under AppData.
- 2.Watch non-browser programs contacting Polygon RPC servers.
- 3.Avoid game cheats, cracked software, and fake AI tool downloads.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1055 Process InjectionT1562.001 Impair Defenses: Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1497 Virtualization/Sandbox Evasion
- Organizations
- Akatsuki LegionElastic Security LabsMorphisec
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | betterdiscordapp.live | tribution hub Domain yimmodmenu[.]org, luxurycheats[.]live, betterdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]p |
| domain | cheatseller.com | s: elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com. These sites share the same image files, which points to |
| domain | dlss5swapper.pro | rdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]pro, scoobymenu[.]live Related domains sharing IPs with main |
| domain | elitecheatsx.live | cked YouTube Channels Akatsuki Legion found four main hubs: elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com. T |
| domain | elitemods.shop | Akatsuki Legion found four main hubs: elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com. These sites share t |
| domain | luxurycheat.live | odmenu[.]org, luxurycheats[.]live, betterdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]pro, scoobymenu[.]liv |
| domain | luxurycheats.live | seller[.]com Main distribution hub Domain yimmodmenu[.]org, luxurycheats[.]live, betterdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta |
| domain | matic-mainnet.chainstacklabs.com | .]network, rpc[.]ankr[.]com, polygon-mainnet[.]infura[.]io, matic-mainnet[.]chainstacklabs[.]com, polygon-mainnet[.]g[.]alchemy[.]com Polygon RPC endpoi |
| domain | polygon-mainnet.g.alchemy.com | ainnet[.]infura[.]io, matic-mainnet[.]chainstacklabs[.]com, polygon-mainnet[.]g[.]alchemy[.]com Polygon RPC endpoints used for fallback C2 SHA256 251 |
| domain | polygon-mainnet.infura.io | rpc[.]com, rpc-mainnet[.]matic[.]network, rpc[.]ankr[.]com, polygon-mainnet[.]infura[.]io, matic-mainnet[.]chainstacklabs[.]com, polygon-mainnet[ |
| domain | polygon-rpc.com | nu[.]live Related domains sharing IPs with main hubs Domain polygon-rpc[.]com, rpc-mainnet[.]matic[.]network, rpc[.]ankr[.]com, polygon |
| domain | rpc.ankr.com | bs Domain polygon-rpc[.]com, rpc-mainnet[.]matic[.]network, rpc[.]ankr[.]com, polygon-mainnet[.]infura[.]io, matic-mainnet[.]chainst |
| domain | rpc-mainnet.matic.network | omains sharing IPs with main hubs Domain polygon-rpc[.]com, rpc-mainnet[.]matic[.]network, rpc[.]ankr[.]com, polygon-mainnet[.]infura[.]io, matic |
| domain | satano.xyz | ound four main hubs: elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com. These sites share the same image |
| domain | scoobymenu.live | luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]pro, scoobymenu[.]live Related domains sharing IPs with main hubs Domain polygon |
| domain | yimmenu-gta5.com | cheats[.]live, betterdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]pro, scoobymenu[.]live Related domains sh |
| domain | yimmodmenu.org | n hub Domain cheatseller[.]com Main distribution hub Domain yimmodmenu[.]org, luxurycheats[.]live, betterdiscordapp[.]live, luxurychea |
| md5 | 23189bc66fc17afca7d0f8f81def27dc | 178271eef6504199b8ca60405e1698879696e49d4 Decoy payload MD5 23189bc66fc17afca7d0f8f81def27dc YimMenuV2_Enhanced.rar MD5 23337b495bcb5c3635d9c89adb4e40ee |
| md5 | 23337b495bcb5c3635d9c89adb4e40ee | 23189bc66fc17afca7d0f8f81def27dc YimMenuV2_Enhanced.rar MD5 23337b495bcb5c3635d9c89adb4e40ee CheraxMenu.rar MD5 3c609886f8b49ebfd7c7c279abc74cb4 YimMenu |
| md5 | 3c609886f8b49ebfd7c7c279abc74cb4 | rar MD5 23337b495bcb5c3635d9c89adb4e40ee CheraxMenu.rar MD5 3c609886f8b49ebfd7c7c279abc74cb4 YimMenuV1_Legacy.rar MD5 c083a98b7041991528225a4b85bfae67 E |
| md5 | c083a98b7041991528225a4b85bfae67 | 5 3c609886f8b49ebfd7c7c279abc74cb4 YimMenuV1_Legacy.rar MD5 c083a98b7041991528225a4b85bfae67 EliteCheatsX-2.0.zip Resource hash 44d72fd03a76d5a1357c1cbe |
| sha256 | 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d | emy[.]com Polygon RPC endpoints used for fallback C2 SHA256 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d Initial ZIP archive SHA256 d23b9609b06ab23243543ee0d8ff0d4c |
| sha256 | 44d72fd03a76d5a1357c1cbe0eb4b94d079e0e6820cc8c6ebcc82737767f7577 | 7041991528225a4b85bfae67 EliteCheatsX-2.0.zip Resource hash 44d72fd03a76d5a1357c1cbe0eb4b94d079e0e6820cc8c6ebcc82737767f7577 Linked to about 70 domains Resource hash f6be9f1e47c2e2bb1a |
| sha256 | 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc | 66530576fa37bb2ecde97309ebbc9e Stage 1 packer/stager SHA256 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc Stage 2 in-memory payload SHA256 851383fb22dcb1d16367839178 |
| sha256 | 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 | f7f7c8acd9c429fcdabd656ffc Stage 2 in-memory payload SHA256 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 Decoy payload MD5 23189bc66fc17afca7d0f8f81def27dc YimMenuV |
| sha256 | d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e | c11476b2fc6a5baa3f9c64a9134cd61d Initial ZIP archive SHA256 d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e Stage 1 packer/stager SHA256 724b400afcec2064a3477abd9a1171 |
| sha256 | f6be9f1e47c2e2bb1a47c7f917bae7b6d73f0d4edd26c6a8d81f1375ce55475e | 6ebcc82737767f7577 Linked to about 70 domains Resource hash f6be9f1e47c2e2bb1a47c7f917bae7b6d73f0d4edd26c6a8d81f1375ce55475e Linked to about 30 domains Note: IP addresses and domains a |
From the original article
4 min read at cybersecuritynews.com
A credential-stealing malware called RevStealer is now spread through more than 100 linked domains, hijacked YouTube channels, and fake AI tools. It targets gamers, content creators, and people who want free software. The goal is simple: steal saved passwords, cookies, game accounts, and crypto wallets, then disappear.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.