Four REVSTEALER Modules Shut Down Defender to Mine Crypto

REVSTEALER malware has four companion modules that linger on infected Windows machines long after the core stealer erases itself, Elastic Security Labs said in research published September 2. One of those modules, LockAppHost, disables 5 Windows Update services, kills 11 scheduled update tasks, strips Microsoft Defender's protections, and buries a cryptocurrency miner inside processes Windows itself owns. Elastic named all four programs (ProManager, WinUpdate, SoftManager, and LockAppHost) in a technical white paper tied to REVSTEALER, a commercial infostealer sold since at least February 2026.

The Core Stealer Vanishes. The Damage Doesn't.

REVSTEALER's main payload collects browser passwords and cookies, files from more than 50 cryptocurrency wallets, session data from Telegram and other messaging clients, VPN and FTP configurations, Windows Credential Manager data, and selected documents. For Roblox, it goes further: it decrypts the stored session cookie so an attacker can take over the account without ever knowing the password. Chrome's App-Bound Encryption is not the obstacle it should be either. The stealer launches the browser inside a debugger process and reads the decryption key directly from memory.

Elastic says that Chrome technique was likely adapted from the public ElevationKatz project. VoidStealer used the same approach in March 2026, and Gen Digital described it at the time as the first infostealer to use the method in the wild. After pulling all of that data, REVSTEALER reports success to its server, deletes itself, and leaves no persistence markers on disk. What it leaves behind are four modules already installed in the user profile, running quietly while the machine looks clean.

What LockAppHost, ProManager, and the Other Modules Actually Do

Each module is a standalone executable that installs itself into the user profile independently. Elastic recovered all four during the same REVSTEALER investigation and identified the connection through shared code: same packer, same runtime function-resolution technique, same Polygon smart contract infrastructure for backup configuration. No live hand-off from the core stealer to these programs was observed during the investigation. The link is forensic rather than witnessed.

• LockAppHost: The most destructive of the four. Abuses the Windows CMSTP binary to escalate to administrator rights without triggering a standard UAC prompt, falling back to a normal elevation dialog if that technique fails. Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables 5 Windows Update services, kills 11 scheduled update tasks and 2 malware removal tasks, then hides a miner inside a suspended nslookup.exe or svchost.exe process. The defensive damage remains after the miner is removed.
• ProManager: Targets Electron-based desktop crypto wallet apps. Reads the wallet window's saved screen position and overlays attacker-supplied content at those exact pixel coordinates, without touching the wallet program itself. A companion component records keystrokes and clipboard pastes from password and passphrase fields.
• WinUpdate and SoftManager: Two additional persistence modules sharing REVSTEALER's build tradecraft. Elastic's public YARA rules cover both for detection; full behavioral analysis is in the white paper.

How Does REVSTEALER Dodge Server Takedowns?

Standard malware operations collapse when researchers seize the command-and-control server. REVSTEALER has a fallback that costs fractions of a cent to update: EtherHiding. If the primary C2 goes offline, the malware reads a replacement server address from a smart contract on the Polygon blockchain. Seizing a domain does nothing to that contract. Every infected machine gets redirected on the next check-in, and the operator pays almost nothing to make it happen.

The evasion stack runs deep. REVSTEALER scores the host against 10 sandbox detection criteria and stops running if the combined score is too high. It terminates on systems configured for one of 10 languages used across Russia and Central Asia. Windows API functions are resolved at runtime without a normal import table; kernel calls go through indirect system calls to slide past the hooks endpoint security products install. Unpacked builds add one more gate: a popup demanding a random 6-character verification code before execution, a manual check against automated analysis tools that Elastic compared to methods seen in Lumma Stealer and AuraStealer.

Fake AI Tools and 17 Hijacked YouTube Channels

REVSTEALER spreads through two main vectors: game-cheat downloads and software impersonation. Elastic found 17 YouTube channels, many of them hijacked from legitimate creators, running short AI-generated videos that pointed to cheat download sites. Game cheats have been a malware delivery staple for years. The software impersonation angle is the one that stands out here.

Morphisec documented a fake "Claude Opus 5 Free Desktop" application on August 31 that copied Anthropic's branding to deliver the malware. There is no indication Anthropic was compromised. The attack simply cloned the product's appearance and relied on users searching for a free version of a paid AI tool. It worked because the lure looked credible. The public ProManager YARA rules from Elastic's artifacts repository cover the core stealer and three of the four modules, but LockAppHost, the module doing lasting structural damage, is absent from the public file. That gap matters.

Elastic's detection rules matched roughly 4,700 samples on VirusTotal across the past year, counting files rather than confirmed infections. Gen Threat Labs first documented REVSTEALER in July; Elastic's September report and white paper are the most thorough public account of the malware to date.

What Should Infected Users Actually Do?

A clean scan is not a clean machine. Because the core stealer deletes itself, endpoint tools scanning for persistence won't find it. That absence proves nothing. The four modules it planted are still running. An infected machine can look fully resolved while LockAppHost is still mining crypto and ProManager is still waiting for a wallet to open.

Where LockAppHost ran, the fix list is specific: re-enable the Windows Update services and scheduled tasks it disabled, remove the Defender exclusions it added, and look for a miner hiding inside a suspended nslookup.exe or svchost.exe. Those processes do not suspend under normal operating conditions. Their presence in a suspended state is a reliable signal.

Password resets alone will not contain the damage. The stealer captured session cookies alongside credentials, so every active session on browsers, crypto wallets, Telegram, and gaming platforms needs to be terminated. Chrome's App-Bound Encryption key was also taken, which means Chrome's entire saved credential set should be treated as exposed. For prevention: install AI tools only from official publisher sources, and treat any "free" desktop version of a paid AI application as a threat until proven otherwise.