Elastic Security Labs has uncovered four auxiliary programs linked to the emerging infostealer known as REVSTEALER. Unlike the core component—which exfiltrates data then self-destructs—these modules remain on the system, disable security features, and, in one case, deploy a crypto miner. This activity set was detailed in a technical white paper published September 2, 2026.
Inside the MODULES: What They Do, How They Survive
The newly identified executables—ProManager, WinUpdate, SoftManager, and LockAppHost—are distinct programs, each with its own persistent mechanism like scheduled tasks, registry run keys, or, in LockAppHost’s case, a system service. Core stealer behavior contrasts sharply: after harvesting passwords, cookies, wallets, messaging data, and files, it reports everything to its command server, deletes itself, and leaves no persistence.
These modules share huge architectural overlap with the stealer itself—same packer, runtime function resolution, even backup configuration stored via Polygon smart contracts. Though none of the modules have yet been observed launching on an already infected host, the shared traits suggest strong ties to REVSTEALER’s infrastructure.
The Most Malicious Module: LockAppHost & Defense Disruption
Of the four, LockAppHost poses the greatest threat. It first gains administrator privileges using the built-in CMSTP tool—or, when that fails, a normal elevation prompt. Once running at high privilege, it disables multiple Windows Update services, stops over a dozen scheduled update or malware removal tasks, excludes key file types and folders from Microsoft Defender, and conceals a miner inside legitimate Windows processes. These changes persist even after the mining activity is discovered, leaving the system exposed to future attacks.
Other modules perform specialized espionage or redirection roles. ProManager captures wallet files and browser extensions, overlays fake content over real wallet apps, logs credentials in password fields, and steals content pasted from the clipboard. WinUpdate watches the clipboard for crypto addresses, substituting them with the attacker’s and harvesting phrases that resemble wallet recovery keys. SoftManager converts the compromised machine into a reverse proxy, routing malicious traffic through the victim’s computer.
Infection Pathways and Defense Tactics
REVSTEALER’s core component first appeared in VirusTotal in February 2026, and it’s been marketed commercially since. It is usually distributed via game cheat software, pirated applications—one impersonating a legitimate AI tool—and short, AI-generated promotional videos on hijacked YouTube channels. Elastic documented roughly 4,700 samples matching the stealer or module signatures in VirusTotal, though that reflects files, not confirmed infections.
The malware is built to avoid detection. It runs sandbox evasion checks, avoids targeting systems with locales used in Russia and Central Asia, dynamically resolves Windows functions without a standard import table, and when its command-and-control server is unreachable, retrieves backup addresses stored on Polygon blockchain smart contracts.
Remediation & Indicators of Compromise
Elastic recommends several steps for recovery after LockAppHost has operated on a system: re-enable disabled Windows Update services and scheduled tasks, remove Microsoft Defender exclusions, and search for mining processes hidden inside normally trusted executables like nslookup.exeor svchost.exe. Users should also change passwords and terminate active sessions—even with reset passwords—to address stolen browser cookies and App-Bound Encryption keys.
Technical indicators include SHA-256 hashes for REVSTEALER and each module, along with command-and-control domains used by ProManager, WinUpdate, and SoftManager. These tools aid detection via YARA rules, behavior analysis, and network monitoring—though LockAppHost lacks a current public YARA rule.
What this means:Unlike most stealers that disappear after execution, REVSTEALER has evolved into a toolkit with persistent companions that degrade security and mine cryptocurrency long after the initial intrusion. Defenders now must assume clean after exfiltration doesn’t mean harmless. Monitoring for module persistence and restoring disabled protections are essential. Watch for future sightings—and tighten defenses around downloads of freeware, cracked tools, or anything from unofficial sources.
