Four REVSTEALER Modules Disable Windows Update and Defender

Elastic Security Labs has documented four previously unreported Windows programs linked to REVSTEALER, an emerging information stealer, that stay behind after the stealer deletes itself. One of them, LockAppHost, switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The security company published its findings and a technical white paper on September 2, naming the four programs ProManager, WinUpdate, SoftManager, and LockAppHost. REVSTEALER has been sold as a commercial infostealer since at least February 2026, when the earliest sample first appeared on VirusTotal.

The core REVSTEALER program steals browser passwords and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files, then reports complete to its server, deletes itself, and leaves no persistence. The four newly documented modules behave differently: each installs into the user's profile and remains there. Elastic recovered the four programs from the same investigation as REVSTEALER and found they share its build tradecraft, including the same packer, runtime function resolution, and use of Polygon smart contracts for backup configuration. The core stealer can also download and run extra executables through the command line, but Elastic did not observe any of the four being delivered to a live REVSTEALER host, so the link rests on shared code and investigative context, not an observed hand-off. Elastic describes the components as an activity set and notes they are separate executables, not plug-ins loaded into the stealer itself.

Each module has a distinct function. ProManager steals wallet files and browser wallet extensions, displays attacker-controlled content over a wallet application's window, and logs passwords typed or pasted into fields it identifies as password or passphrase inputs. WinUpdate watches the clipboard, replaces copied cryptocurrency addresses with the attacker's, and collects text that looks like a wallet recovery phrase; it persists through a scheduled task with a Registry Run key as fallback. SoftManager turns the victim's machine into a reverse proxy that routes the attacker's network traffic through the victim's connection, using a logon script, scheduled task, or Registry Run key. LockAppHost runs a cryptocurrency miner with administrator rights after disabling Windows Update and excluding folders from Microsoft Defender, using a Registry Run key or a service for persistence.

LockAppHost is the most disruptive of the four. To gain administrator rights, it abuses the Windows CMSTP tool, falling back to a standard elevation prompt if that fails. Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables 5 Windows Update services, disables 11 scheduled update tasks and 2 malware removal tasks, and then hides a miner within legitimate Windows processes. The changes it makes to weaken the machine's defenses remain after the miner is found. ProManager targets users of desktop cryptocurrency wallets, many of which are built with the Electron framework. Because the wallet window's position is saved, ProManager opens attacker-supplied content sized and positioned to overlay the real wallet, without touching the wallet program itself. A separate part of that module records what the user types into password and passphrase fields, including values pasted from the clipboard.

Before the modules arrive, REVSTEALER casts a wide net. It collects browser passwords and cookies; files from more than 50 cryptocurrency wallets and a large set of wallet browser extensions; session data from Telegram and other messaging clients; VPN and FTP configuration; the Windows Credential Manager; password managers; and selected documents. For some gaming platforms, it goes further: it decrypts the stored Roblox session cookie, allowing an attacker to take over the account without the password. To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. Elastic said this technique is not new and was likely adapted from the public ElevationKatz project; it was also used by another stealer, VoidStealer, in March 2026, and Gen Digital called VoidStealer the first infostealer seen using it in the wild.

REVSTEALER reaches victims mainly through game-cheat lures. Elastic identified at least 17 YouTube channels, many of which were hijacked from their original owners, that promoted two cheat websites using short AI-generated videos. The malware has also been packaged as pirated or impersonated software, including a fake Claude Opus 5 Free Desktop application that Morphisec documented on August 31. That application copied Anthropic's branding, but there is no indication Anthropic itself was compromised. Elastic's detection rule matched about 4,700 samples on VirusTotal over the past year, a count of files rather than confirmed infections.

The malware is built to resist analysis. It scores each machine against 10 sandbox checks and stops if the total is too high, and it terminates on systems set to one of 10 languages used across Russia and Central Asia. It resolves Windows functions without a normal import table and calls the kernel via indirect system calls to bypass the hooks installed by security products. If its main command server is unreachable, it reads a backup address from a smart contract on the Polygon blockchain, a takedown-resistant method known as EtherHiding. Unpacked builds also show a verification window that asks for a random six-character code before running, a gate against automated analysis that Elastic compares to Lumma Stealer and AuraStealer.

To reduce the risk of infection, avoid downloading free or unofficial versions of paid AI tools and game cheats, and install Claude only from Anthropic's official channels. Elastic has published YARA rules, behavior rules, and a set of indicators for detection and blocking. The public YARA file covers the core stealer and the ProManager, SoftManager, and WinUpdate modules, but does not include a rule for LockAppHost, the mining module. Because the core stealer deletes itself, an infection can appear complete while the modules continue running. Where LockAppHost has run, responders should re-enable the Windows Update services and scheduled tasks that it turned off, remove the Microsoft Defender exclusions it added, and look for a miner hidden in a suspended instance of nslookup.exe or svchost.exe. Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions on their accounts rather than assume a password reset is enough.

For IT teams managing business endpoints, AEU-I offers security-first IT and infrastructure services that can help you assess and harden your environment against threats like this. Gen Threat Labs first documented REVSTEALER in July, and Elastic's report and white paper ar