30
30
45
30
30
30
30
30
REVSTEALER ramps up: analysis of up-and-coming infostealer
Elastic Security Labs analyzes REVSTEALER, an emerging infostealer harvesting browser credentials, cryptocurrency wallets, and gaming accounts.
Elastic Security Labs published a deep-dive analysis of REVSTEALER, described as an up-and-coming infostealer. The malware targets browser data, cryptocurrency wallets, and gaming accounts, with credential harvesting as its core function. The report tracks the family's capabilities as it ramps up activity in the wild.
40
30
30
30
30
30
30
30
30
30
30
30
30
45
30
30
30
30
30
30
Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.
Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.
45
30
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
50
30
30
30
30
30
30
30
30
30