A new campaign involving the credential-stealing malware dubbed RevStealer is leveraging over 100 domains, hijacked YouTube channels, and fake AI tools to target gamers, creators, and anyone looking for free software. Once installed, it harvests passwords, cookies, crypto wallets, game accounts—and then self-destructs without a trace.
The Attack Vector & Distribution Tactics
RevStealer operators are exploiting web searches by masquerading as tools gamers and creators often look for—cheats, account utilities, cracked or “free” versions of paid AI apps. When someone downloads what appears to be a helpful file, they unknowingly trigger a multi-stage infection chain. Key lures include a fake Electron app pitched as Anthropic’s Claude Opus 5.
Security researchers have identified four central domains—elitecheatsx.live, elitemods.shop, satano.xyz, and cheatseller.com—as primary distribution hubs. By tracking shared IPs and image file hashes, analysts uncovered roughly 100 more domains tied to these hubs. One cluster has around 70 domains linked via a single hash, another near 30. Not all are confirmed to deliver RevStealer, and some may be related to other threats like the REMCOS RAT.
Hijacked Channels & Variety of Baits
The campaign makes use of hijacked YouTube channels to publish AI-generated videos about game cheats. These videos include download links in descriptions that lead to malicious domains. The misuse of trusted channels is designed to lower users’ guard by using apparent legitimacy.
Beyond game cheats for titles like Minecraft, Valorant, Fortnite, Counter-Strike 2, and Roblox, the malware is marketed via fake premium tools—Discord Nitro or Canva, Slack, SteelSeries GG upgrades, free VPNs, “unlockers” for ChatGPT, Grok, Gemini, DeepSeek, and pirated media players. The bait is broad and geared for high volume.
How RevStealer Operates & Evades Detection
Once executed, the malware kicks off a multi-stage process. The first stage is protected using VMProtect and runs through Windows tools like PowerShell and WMI, injecting malicious code into other processes. The second stage runs purely in memory—leaving minimal traces on disk. A decoy file is dropped to distract analysts.
Before full activation, RevStealer performs environmental checks—memory size, CPU cores, system language, device uptime, graphics setup—to detect sandboxes or virtual machines. If it flags the system as Russian, Ukrainian, or Central Asian, or fails enough of these tests, it aborts execution—likely to avoid local law enforcement or detection. If passed, the payload (encrypted via AES-256-CBC) is unpacked, stored under AppData, and attempts are made to add that folder to Microsoft Defender’s exclusion list.
Stealing Data & Exfiltration Pathways
RevStealer extracts saved data from major browsers—Chrome, Firefox, Edge, Brave, Vivaldi, Opera—plus histories, cookies, passwords, and can even bypass protections like Chrome’s App-Bound Encryption using hardware breakpoints. It also targets 225 Chromium password-manager extensions, 51 standalone wallet or password applications, and 2FA/VPN tools. Game platforms like Steam, Roblox, Battle.net, EA Desktop, and Minecraft are included—along with screenshots and clipboard data.
Data is transmitted via HTTPS on port 443. If the main command and control server is unavailable, RevStealer employs a fallback mechanism—reading a backup address from a smart contract on Polygon, a technique known as EtherHiding. Because blockchains are immutable, this backup route is particularly resilient.
Cleanup, Ransomware & Indicators to Watch
Post-theft, RevStealer removes itself entirely from the system, minimizing forensic traces. The malware author also maintains the ability to push additional malicious payloads via the same distribution pipeline—including ransomware and even coin-mining via a module called LockAppHost powered by XMRig.
Defenders should keep an eye out for signs such as unusual files in AppData, changes to Microsoft Defender’s exclusion list, and unexpected connections to Polygon RPC services. Avoiding cracked software, game cheats, and pirated content remains one of the most reliable defenses—especially when trusted YouTube channels or SEO help misleading links seem safe.
This campaign exemplifies evolving threats in the digital underground. The use of over 100 domains, hijacked media channels, fake AI tools, and resilient fallback infrastructure shows a high level of sophistication. Users are increasingly at risk via methods that mimic legitimate software releases. What to watch: whether authorities or hosting providers shut down these domains; whether blockchain-based fallbacks like Polygon become more deeply abused; and how malware authors improve evasion to slip past anti-malware defenses and OS protections.
