RevStealer steals browser and wallet credentials via 14 indirect syscalls
Original title: RevStealer Bypasses Security Monitoring With 14 Indirect Syscalls to Steal Browser and Wallet Credentials
Elastic tracks the cluster as REF2859; about 4,700 VirusTotal samples date back to February 2026.
RevStealer is a Windows infostealer spread through gaming-cheat and fake AI-tool lures, including a fake Claude Opus 5 GitHub project. It checks for sandboxes, uses 14 indirect syscalls, and steals browser, wallet, messaging, and gaming credentials before deleting itself. Elastic also documented C2 modules for clipboard swapping, a SOCKS5 proxy, and an XMRig miner. Anthropic was not compromised.
Unconfirmed: The operators behind the REF2859 cluster are not named.
- Elastic counted 225 Chromium extension identifiers and 51 standalone wallet applications.
- Fallback command-and-control uses Polygon smart contracts, a method called EtherHiding.
- For Roblox, the malware decrypts the session cookie for passwordless account takeover.
- Wazuh published rule 117317 for Polygon RPC queries from user-writable paths.
Impact: Steals browser, wallet, gaming, and messaging credentials
- 1.Block cheat and crack site downloads and treat unsigned Electron apps from GitHub as suspect.
- 2.Alert on new Defender exclusions in AppData and Polygon RPC queries from user-writable paths.
- 3.Rotate passwords, revoke sessions, and move wallets from a clean device if a suspect build ran.
- ATT&CK
- T1204.002 Malicious FileT1562.001 Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1539 Steal Web Session CookieT1496 Resource Hijacking
- Products
- WindowsGoogle Chrome
- Threat actors
- REF2859
- Malware
- RevStealerXMRig
- Organizations
- Elastic Security LabsMorphisecGen Threat LabsWazuh
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cheatseller.com | ution Domain satano[.]xyz Domain — Main Distribution Domain cheatseller[.]com Domain — Sample Hash 23189bc66fc17afca7d0f8f81def27dc MD5 |
| domain | elitecheatsx.live | erated “cheat” demos that link to malicious domains such as elitecheatsx[.]live and resight-cheats[.]net. Morphisec observed the most not |
| domain | elitemods.shop | omain elitecheatsx[.]live Domain — Main Distribution Domain elitemods[.]shop Domain — Main Distribution Domain satano[.]xyz Domain — M |
| domain | resight-cheats.net | t link to malicious domains such as elitecheatsx[.]live and resight-cheats[.]net. Morphisec observed the most notable lure, a fake “Claude |
| domain | satano.xyz | n Domain elitemods[.]shop Domain — Main Distribution Domain satano[.]xyz Domain — Main Distribution Domain cheatseller[.]com Domai |
| md5 | 23189bc66fc17afca7d0f8f81def27dc | Distribution Domain cheatseller[.]com Domain — Sample Hash 23189bc66fc17afca7d0f8f81def27dc MD5 YimMenuV2_Enhanced.rar Sample Hash 23337b495bcb5c3635d9 |
| md5 | 23337b495bcb5c3635d9c89adb4e40ee | 7afca7d0f8f81def27dc MD5 YimMenuV2_Enhanced.rar Sample Hash 23337b495bcb5c3635d9c89adb4e40ee MD5 CheraxMenu.rar Sample Hash 3c609886f8b49ebfd7c7c279abc7 |
| md5 | 3c609886f8b49ebfd7c7c279abc74cb4 | 7b495bcb5c3635d9c89adb4e40ee MD5 CheraxMenu.rar Sample Hash 3c609886f8b49ebfd7c7c279abc74cb4 MD5 YimMenuV1_Legacy.rar Sample Hash b2e255a8054625c702abf0 |
| md5 | b2e255a8054625c702abf025752dd37d | b49ebfd7c7c279abc74cb4 MD5 YimMenuV1_Legacy.rar Sample Hash b2e255a8054625c702abf025752dd37d MD5 Cherax product page Note: IP addresses and domains are |
From the original article
3 min read at gbhackers.com
A fast-moving Windows infostealer called RevStealer is abusing gaming-cheat and fake AI tool lures to steal browser, wallet, and gaming credentials. It uses 14 indirect syscall wrappers to evade endpoint monitoring. Elastic Security Labs tracks the cluster as REF2859.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.