REVSTEALER Malware Leaves Persistent Backdoors After Stealing Credentials, Elastic Warns

Elastic Security Labs has uncovered four previously undocumented Windows malware components linked to the REVSTEALER information-stealing malware, including a cryptocurrency miner that disables Microsoft Defender and Windows Update to maintain control over infected systems.

The newly identified components, named ProManager, WinUpdate, SoftManager, and LockAppHost, can remain active on a compromised computer even after the main REVSTEALER stealer deletes itself.

Elastic published its findings on September 2, 2026, describing REVSTEALER as an emerging commercial Windows information stealer that has been available since at least February 2026.

REVSTEALER Malware Expands Beyond Information Theft

REVSTEALER is primarily designed to steal sensitive information from Windows systems.

The malware can collect:

  • Browser passwords and cookies
  • Cryptocurrency wallet files
  • Browser-based crypto wallet extensions
  • Gaming account information
  • Telegram and other messaging data
  • VPN and FTP configurations
  • Windows Credential Manager data
  • Password manager information
  • Documents and other selected files

The malware can also steal session information that may allow attackers to take over accounts without knowing the victim's password.

Elastic found that REVSTEALER can specifically target Roblox sessions by decrypting stored session cookies.

The malware also uses a technique that launches Chrome under a debugger to extract keys associated with Chrome App-Bound Encryption, allowing attackers to access protected browser credentials.

Four New Malware Components Discovered

Unlike the primary REVSTEALER executable, which deletes itself after successfully exfiltrating stolen information, the four newly identified components establish persistence on the victim's machine.

1. ProManager

ProManager targets cryptocurrency wallet users.

It can:

  • Steal cryptocurrency wallet files
  • Target browser wallet extensions
  • Capture passwords and passphrases
  • Monitor information entered or pasted into password fields
  • Overlay attacker-controlled content on top of legitimate cryptocurrency wallet applications

Because many desktop cryptocurrency wallets use the Electron framework, ProManager can determine the wallet application's window position and place malicious content over the legitimate interface.

This technique can potentially trick users into entering sensitive wallet credentials or recovery information.

Persistence: Registry Run key.

2. WinUpdate

Despite its legitimate-sounding name, WinUpdate is a malicious component designed to target cryptocurrency users.

It monitors the Windows clipboard and can replace copied cryptocurrency wallet addresses with attacker-controlled addresses.

It can also search clipboard contents for cryptocurrency recovery phrases.

Persistence:

  • Scheduled task
  • Registry Run key as a fallback

This creates a serious risk for users who copy and paste cryptocurrency addresses when making transactions.

3. SoftManager

SoftManager turns an infected Windows system into a reverse proxy.

This allows attackers to route their network traffic through the victim's internet connection.

The malware can therefore abuse the compromised machine as an intermediary for additional malicious activity.

Persistence:

  • Logon script
  • Scheduled task
  • Registry Run key

4. LockAppHost

LockAppHost is the most disruptive component identified by Elastic.

It installs a cryptocurrency miner and attempts to obtain administrator privileges before weakening the victim's security controls.

After gaining elevated privileges, LockAppHost can:

  • Add Microsoft Defender exclusions
  • Disable Windows Update services
  • Disable Windows Update scheduled tasks
  • Disable malware-removal tasks
  • Hide cryptocurrency mining activity inside legitimate Windows processes

The malware abuses the Windows CMSTP utility when attempting to obtain administrator privileges. If that method fails, it can fall back to a standard elevation prompt.

Elastic found that LockAppHost disables five Windows Update services, 11 scheduled update tasks, and two malware-removal tasks.

These changes can remain on the system even after the cryptocurrency miner is discovered and removed.

REVSTEALER Uses Multiple Persistence and Evasion Techniques

The malware family is designed to make analysis and detection more difficult.

REVSTEALER performs multiple sandbox checks and can terminate when it determines that it is running in an analysis environment.

It also avoids execution on systems configured for several languages commonly used across Russia and Central Asia.

The malware resolves Windows APIs dynamically rather than relying on a conventional import table and uses indirect system calls to make security-product analysis more difficult.

Blockchain Used as Backup C2 Infrastructure

One of REVSTEALER's notable features is its use of the Polygon blockchain for backup command-and-control configuration.

If its primary C2 server becomes unreachable, the malware can retrieve another address from a smart contract.

This technique, commonly referred to as EtherHiding, provides attackers with a more resilient method of storing or retrieving infrastructure information.

Because blockchain-based infrastructure is difficult to take down using conventional domain or server-level methods, it can complicate incident response.

Malware Distributed Through Game Cheats and Fake Software

Elastic found that REVSTEALER is primarily distributed through game-cheat lures.

Researchers identified at least 17 YouTube channels promoting malicious cheat websites, with several channels reportedly hijacked from their original owners.

The malware has also been distributed through pirated and impersonated software.

One example identified by Morphisec was a fake "Claude Opus 5 Free Desktop" application that copied Anthropic's branding.

There is no indication that Anthropic itself was compromised.

The campaign demonstrates how threat actors continue to use popular AI software, gaming tools, and free applications as lures for malware distribution.

REVSTEALER Deletes Itself, But the Infection May Continue

One of the most important findings from Elastic's research is that removing the primary REVSTEALER executable does not necessarily remove the entire infection.

The main stealer can complete its information theft, report the operation as successful, delete itself, and leave behind the additional persistent components.

This means an infected system may appear clean during a basic investigation even though ProManager, WinUpdate, SoftManager, or LockAppHost remains active.

Security teams should therefore investigate persistence mechanisms and suspicious changes to Windows services, scheduled tasks, registry keys, and Microsoft Defender configuration.

What to Do If REVSTEALER Is Suspected

Users and organizations should avoid downloading unofficial versions of paid software, game cheats, cracked applications, and suspicious AI tools.

For systems suspected of infection, security teams should:

  1. Isolate the affected machine from the network.
  2. Investigate Registry Run keys and scheduled tasks.
  3. Check Windows Update services for unexpected changes.
  4. Review Microsoft Defender exclusions.
  5. Search for unauthorized cryptocurrency miners.
  6. Inspect suspicious instances of legitimate Windows processes.
  7. Change passwords for accounts accessed from the infected system.
  8. Terminate active sessions and revoke authentication tokens.
  9. Review cryptocurrency wallets and transaction history.
  10. Use endpoint security tools to search for REVSTEALER and its associated components.

Because REVSTEALER can steal browser cookies and protected browser credentials, simply changing a password may not be sufficient. Active sessions should also be terminated and authentication tokens invalidated where possible.

Elastic Publishes Detection Rules

Elastic has released YARA rules, behavioral detection rules, and indicators of compromise associated with REVSTEALER.

The publicly available YARA rule covers the main stealer as well as the ProManager, SoftManager, and WinUpdate components. Elastic noted that the published YARA file does not currently include a rule for LockAppHost.

Selected Indicators of Compromise

REVSTEALER

SHA-256: adc4aa652965396b52e79435ca54987ae9eb21bf5e67de5e9461b09655165ee4

ProManager

SHA-256: 13d7237d7289e67c2d806a65d52580b453ce4987acbe2c4c4d04833f55ebccfa

WinUpdate

SHA-256: 7c08cf409194056a8517865e5d3433d1499bb8262263b55b49b8b07d9d182fcb

SoftManager

SHA-256: 14b2ac356ed75d10ef40bbaaa48e7dd9fff7de9719c2a43ad123fe843dd4e4e2

LockAppHost

SHA-256: c66d2b77b9e85c53391891212413ad9a99eb66f4b11c6a431e78884a5b2651e5

C2 Domains

  • monitor5.roast-core85[.]click
  • config.hubdisplay[.]lol
  • health.journal-metric[.]lol
  • metric.gardenpark[.]click

Key Takeaway

REVSTEALER highlights a growing trend in Windows malware where an information stealer is only the first stage of a larger compromise.

The main malware can steal credentials, browser sessions, cryptocurrency data, and sensitive files before deleting itself. Meanwhile, additional components can remain persistent and provide attackers with credential theft, clipboard manipulation, proxy capabilities, and cryptocurrency mining.

For defenders, the key lesson is simple: a disappearing infostealer does not necessarily mean the infection is gone.

Organizations investigating REVSTEALER infections should examine persistence mechanisms, security-control changes, active sessions, credentials, and network activity rather than relying only on the presence of the original stealer executable.