Affected Systems

Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes. Targets cryptocurrency wallet users, gamers, and general Windows users via game-cheat lures and pirated software.

Exploitation Status

Active campaign. REVSTEALER sold commercially since at least February 2026. Elastic detected approximately 4,700 samples on VirusTotal over the past year. Distribution via 17+ YouTube channels (many hijacked) promoting cheat websites, and fake software packages. No CVE assigned (malware campaign, not vulnerability).

Business Impact

LockAppHost module disables Windows Update and Microsoft Defender, then runs cryptocurrency miner with admin rights—defenses remain weakened after miner removal. ProManager overlays fake windows on cryptocurrency wallets to steal credentials. SoftManager turns endpoints into reverse proxies routing attacker traffic. WinUpdate performs clipboard hijacking to replace crypto addresses. Core stealer exfiltrates browser passwords (bypassing Chrome App-Bound Encryption via debugger), cookies, 50+ wallet types, Telegram sessions, VPN/FTP configs, password managers, and documents. Uses blockchain-based C2 fallback (Polygon smart contracts) for resilience against takedowns. Anti-analysis features include sandbox detection, geofencing (terminates in Russia/Central Asia), and indirect syscalls to evade EDR hooks.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Hunt for persistence mechanisms: Registry Run keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run, scheduled tasks, logon scripts, and services matching names ProManager, WinUpdate, SoftManager, LockAppHost
  • Check for disabled Windows Update services and Defender exclusions added to common folders—review Group Policy and scheduled task status for 11 update tasks and 2 malware removal tasks disabled by LockAppHost
  • Deploy Elastic's published detection rules and IOCs from September 2 white paper; search VirusTotal for related samples using shared packer and Polygon smart contract configuration patterns
  • Block execution of files promoted via game-cheat YouTube channels and pirated software; educate users on risks of downloading cheats, cracks, and unofficial desktop applications
  • Monitor for Chrome launched with debugging flags (--remote-debugging-port) and processes performing indirect system calls to bypass EDR; review network traffic to Polygon blockchain smart contracts for C2 communication