REVSTEALER is a commercial Windows infostealer first sold on underground forums since at least February 2026, tracked by Elastic Security Labs as REF2859. Over approximately 4,700 samples have been observed on VirusTotal. The malware is distributed primarily through social engineering: at least 17 hijacked YouTube channels post short AI-generated videos advertising free game cheats directing users to cheat websites (elitecheatsx[.]live, resight-cheats[.]net), and a malicious GitHub repository impersonating a 'Claude Opus 5 Free Desktop' application distributed the malware as a trojanized Electron desktop app. Samples are also disguised as legitimate software installers including Slack, qBittorrent, SteelSeries GG, and Blender.

The core REVSTEALER payload is heavily protected with the VMProtect packer and implements extensive anti-analysis measures. A 10-point weighted sandbox-scoring system checks CPU core count, RAM threshold, GPU/PCI vendor, system uptime, process blocklists, username/computer-name blocklists, timing discrepancies, Media Foundation presence, CPUID, and virtualization artifacts; if the total score reaches 7 or higher, the malware self-terminates without executing. It also performs CIS-region language checks on the default system locale and keyboard layout using FNV-1a hashing against a precomputed table of 10 languages (Russian, Ukrainian, Belarusian, Tajik, Armenian, Azerbaijani, Kazakh, Kyrgyz, Turkmen, Uzbek), terminating if a match is found. All Windows API calls are resolved through custom FNV-1a hash lookups with no import table, and the malware uses 14 indirect syscall wrappers to bypass user-mode security-product hooks. A Vectored Exception Handler (VEH) is installed for additional evasion. Unpacked builds present a verification window requiring a random six-character code before execution, a gate designed to hinder automated sandbox analysis.

Once execution proceeds, REVSTEALER performs extensive victim profiling: it collects system information (OS version, CPU, RAM, GPU, hostname, username, locale, timezone, keyboard layout, screen resolution), dumps all environment variables via GetEnvironmentStringsW, enumerates running processes, reads installed applications from the registry, captures clipboard contents, and takes a full-screen screenshot. It then targets a broad range of data sources including browser credential databases (Chromium Login Data and Cookies SQLite databases plus Firefox), Chrome's App-Bound Encryption (bypass achieved by launching the browser in debugger mode, locating App-Bound decryption code, setting a hardware breakpoint, and reading the decrypted key from memory — a technique adapted from the public ChromeKatz/ElevationKatz project), 51+ standalone cryptocurrency wallet applications and 225 Chrome extension identifiers covering wallets and password managers, Windows Credential Manager via CredEnumerateW, Telegram Desktop by scanning all drives for tdata directories and stealing key files enabling full account takeover, Steam local.vdf and loginusers.vdf, Roblox session cookies decrypted via CryptUnprotectData, Minecraft launcher configurations across 8 paths, Battle.net, EA Desktop, Battlestate Games (Escape from Tarkov), messaging apps (Tox, Psi+, Pidgin, Session, Element, Slack) for private keys and chat history, VPN and FTP client configurations, OBS Studio profiles with stream keys, and user-selected documents. Exfiltrated data is LZ77-compressed, tagged with magic-value identifiers, and streamed directly to the C2 server via HTTPS without writing a single archive file to disk. After reporting completion, the core stealer deletes itself with no persistence.

C2 communication uses AES-256-CBC encryption with embedded 32-byte keys and IV-prefixed blobs. The primary C2 endpoint is a hardcoded hostname validated via a GET request to /ext/status that must return 'active'. If the primary server is unreachable, the malware queries up to five public Polygon JSON-RPC endpoints (polygon-bor-rpc.publicnode.com, poly.api.pocket.network, polygon.lava.build, polygon-public.nodies.app, polygon.drpc.org) to read an encrypted fallback C2 address from a Polygon smart contract via eth_call, decrypting it with the embedded AES key. This EtherHiding technique makes C2 infrastructure takedown extremely difficult as operators can rotate endpoints by updating the blockchain contract without rebuilding the malware. Extracted C2 configurations include monitor5.roast-core85[.]click (primary), polygon.iwmukj[.]xyz, polygon.mnyhgxda[.]xyz, static4.livelab[.]one, and meta7[.]archscreen68[.]one. C2 API routes include /ext/status, /ext/sync/ucluv.wkku, /ext/push/ucluv.wkku, /ext/events/ucluv.wkku, and /ext/ping/ucluv.wkku.

Beyond the core stealer, REVSTEALER's C2 infrastructure can deliver four self-contained follow-on modules, each with its own Polygon smart-contract dead-drop address and independent persistence:

1. ProManager (ProManagerServicedc894.exe): Steals wallet files and browser wallet extensions, displays phishing overlays sized and positioned to match target wallet applications, captures passwords typed or pasted into password/passphrase fields, and can deliver additional payloads. Persists via Registry Run key. C2: config.hubdisplay[.]lol, Polygon contract 0x98FF8e7cdC13AE46b83B7590B986F25f1560DF03.

2. WinUpdate (WinUpdate60e3a3.exe): A cryptocurrency clipboard hijacker that monitors clipboard contents and replaces copied cryptocurrency addresses with the attacker's address. Also collects text resembling wallet recovery phrases (mnemonic seeds). Primary persistence via scheduled task with Registry Run key as fallback. CIS language check terminates on 10 languages. C2: health.journal-metric[.]lol, Polygon contract 0x0cF1Ec8B9551103de729c3b02D77221Da9d81Acc.

3. SoftManager (SoftManager72fb40.exe): Implements a reverse SOCKS5 proxy that routes attacker network traffic through the victim's connection over an encrypted WebSocket protocol, providing backconnect access to the compromised host. Persists via logon script, scheduled task, or Registry Run key. CIS language check terminates on 10 languages. C2: metric.gardenpark[.]click, Polygon contract 0x0E04c59f31E382D2B8A1637f4B9A5f04165EC48d.

4. LockAppHost (LockAppHost14a02b.exe): The most disruptive module, deploying the XMRig Monero cryptocurrency miner. It abuses Windows CMSTP (Microsoft Connection Manager Profile Installer) to bypass UAC and gain administrative privileges, falling back to a standard UAC prompt if CMSTP is unavailable. It enables SeDebugPrivilege and uses direct syscall stubs for process manipulation. It disables 5 Windows Update services (UsoSvc, WaaSMedicSvc, wuauserv, BITS, dosvc), 11 scheduled Windows Update tasks, and 2 Windows malware-removal tasks. It adds Microsoft Defender exclusions for common folders and file types by modifying registry keys. The XMRig miner is deployed via process hollowing into suspended instances of svchost.exe or nslookup.exe. On Windows 11 24H2, it patches NtManageHotPatch to bypass Memory Integrity (HVCI) protections. The mining configuration is retrieved from a separate Polygon contract (0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53, selector 0x11582022), with the mining pool pointing to pool.supportxmr[.]com:443 with TLS. LockAppHost also continuously monitors running processes every second, pausing XMRig when diagnostic or monitoring tools are detected. It persists via Registry Run key or a Windows service. Crucially, the defense-weakening changes (disabled Windows Update, disabled Defender, removed exclusions) persist even after the miner is detected and removed, requiring manual remediation.