REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2, and gaming-focused social engineering

Key facts

Detection coverage

As of 2026-09-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2370 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: REVSTEALER — Trojanized Electron Application Execution from AppData with Sandbox Evasion Indicators

Detects execution of REVSTEALER's trojanized Electron loader launched from %USERPROFILE%\AppData.*\* paths. The malware is delivered via fake Claude Opus 5 desktop app, game-cheat software, or other trojanized Electron applications hosted on GitHub. The detection identifies the process tree where an Electron app (electron.exe or renamed variant) spawns from a suspicious staging directory, combined with the characteristic AppData staging path pattern and the mutex Global\5B908BC4. Also flags sandbox-evasion behaviors: FNV-1a hashed system checks, CPU core / RAM enumeration, and sleep/timing check patterns that precede the 10-test weighted sandbox scoring system.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204, T1082, T1497.001, T1622, T1027.002
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search (ParentImage="*\\AppData.*\\*" Image="*\\AppData.*\\*.exe")
   OR (CommandLine="*--remote-debugging-port*" Image="*\\chrome.exe")
   OR (CommandLine="*app-ri9icle2.res*")
| eval is_revstealer_loader=if(match(Image, "(?i)\\(?:electron|ClaudeOpus5|slack|qBittorrent|SteelSeries|Blender)\\.exe$") AND match(CommandLine, "(?i)\\(?:app-|electron)"), 1, 0)
| eval has_staging_path=if(match(Image, "\\AppData\\.{8,20}\\.+"), 1, 0)
| search is_revstealer_loader=1 OR has_staging_path=1
| eval sandbox_check=if(match(CommandLine, "(?i)(?:cpuid|core|cpu|GetSystemInfo|GlobalMemoryStatus|VirtualAlloc|NtQuerySystemInformation)"), 1, 0)
| where is_revstealer_loader=1 OR (has_staging_path=1 AND sandbox_check=1)
| table _time, ComputerName, User, Image, ParentImage, CommandLine, has_staging_path, is_revstealer_loader, sandbox_check
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FolderPath has_any (@"\\AppData.\\", @"\\AppData\\Local\\Temp")
    and FileName endswith ".exe")
    or ProcessCommandLine has_any ("--remote-debugging-port", "app-ri9icle2.res", "ClaudeOpus5")
| extend IsRevStealerLoader = iff(
    FileName has_any ("electron", "ClaudeOpus5", "slack", "qBittorrent", "SteelSeries", "Blender")
    and (ProcessCommandLine has "app-" or ProcessCommandLine has "electron"),
    1, 0)
| extend HasStagingPath = iff(FolderPath matches regex @"\\AppData\\.{8,20}\\.+", 1, 0)
| extend SandboxCheck = iff(
    ProcessCommandLine has_any ("cpuid", "core", "cpu", "GetSystemInfo", "GlobalMemoryStatus", "VirtualAlloc", "NtQuerySystemInformation"),
    1, 0)
| where IsRevStealerLoader == 1 or (HasStagingPath == 1 and SandboxCheck == 1)
| project Timestamp, DeviceName, AccountName, FolderPath, ParentProcessFileName, ProcessCommandLine, HasStagingPath, IsRevStealerLoader, SandboxCheck
| sort by Timestamp desc

Sigma

title: REVSTEALER Trojanized Electron Application Execution from AppData
id: 3a7b1e2c-9f4d-4b8a-ae12-6d5f3e8c9a0b
status: experimental
description: Detects execution of REVSTEALER trojanized Electron loader from suspicious AppData staging paths, characteristic of the fake Claude Opus 5 desktop app and game-cheat software distribution campaigns. The loader decrypts an embedded AES-256-CBC payload (app-ri9icle2.res) and writes it to a randomized AppData subdirectory before execution.
references:
    - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
    - https://assets.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt9cd59668ba5a104d/6a97978bd04dac6f166ca8ce/REVSTEALER_-_White_paper.pdf
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
author: Threadlinqs Team
date: 2026-09-07
tags:
    - attack.initial_access
    - attack.execution
    - attack.defense_evasion
    - attack.t1204
    - attack.t1082
    - attack.t1497.001
    - attack.t1622
    - attack.t1027.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_staging:
        Image|contains|all:
            - '\AppData.'
            - '.exe'
        Image|contains:
            - '\electron'
            - '\ClaudeOpus5'
    selection_remote_debug:
        CommandLine|contains: '--remote-debugging-port'
    selection_payload:
        CommandLine|contains: 'app-ri9icle2.res'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Electron applications running from AppData (e.g., Discord, Slack, Visual Studio Code)
    - Legitimate Chrome remote debugging for developer workflows
    - Authorized software installations from non-standard paths
level: high

Known false positives:

• Legitimate Electron applications (Discord, Slack, VS Code) running from AppData directories
• Developer Chrome debug sessions with --remote-debugging-port flag
• Authorized software installations in non-standard paths

Tuning notes: Baseline legitimate Electron applications in the environment (Discord, Slack, VS Code) and exclude their known paths. For Chrome remote debugging, exclude developer workstations with documented approval. Adjust the AppData staging path pattern if the randomization length changes in future variants. Correlate with Sysmon EventCode 11 (FileCreate) for the 'app-ri9icle2.res' resource file as a secondary signal.

• 🔒 REVSTEALER — Windows Defender Exclusion Abuse and Windows Update Service Disablement (LockAppHost Module) · unlock with TL Creds
• 🔒 REVSTEALER — Browser Credential and Cookie Theft via Chrome Profile Database Access · unlock with TL Creds
• 🔒 REVSTEALER — SoftManager Reverse SOCKS5 Proxy and WinUpdate Clipboard Hijacking (Follow-On Modules) · unlock with TL Creds
• 🔒 REVSTEALER — Persistence via Registry Run Keys and Scheduled Tasks · unlock with TL Creds
• 🔒 REVSTEALER — ProManager Cryptocurrency Wallet Theft Module · unlock with TL Creds
• 🔒 REVSTEALER — Self-Deletion, Streaming Exfiltration, and C2 Communication Beacon · unlock with TL Creds
• 🔒 REVSTEALER — Chrome App-Bound Encryption Bypass via Debugger-Launched Browser Process · unlock with TL Creds
• 🔒 REVSTEALER — Polygon Blockchain Smart Contract C2 Dead Drop Resolution · unlock with TL Creds

Indicators of compromise

As of 2026-09-07, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-2370.

Sample indicators (3 of 28)

• Domain: monitor5[.]roast-core85[.]click
• File hash: 4c897108e8e793d6904110928c996815c302d6975c9bc61162149e855a963d50
• Domain: config[.]hubdisplay[.]lol

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

Technical analysis

It features a Chrome App-Bound encryption bypass (influenced by ElevationKatz/ChromeKatz), a Polygon blockchain smart-contract dead drop for resilient C2 failover, a 10-test weighted sandbox-scoring anti-analysis system, VMProtect packing, indirect syscalls, and a modular post-exploitation framework with four follow-on modules for cryptocurrency theft, clipboard hijacking, reverse SOCKS5 proxy, and XMRig cryptomining deployment.

REVSTEALER (tracked by Elastic Security Labs as REF2859) is a commercially sold Windows infostealer that has been active since at least February 2026, when the earliest sample was submitted to VirusTotal. It is distributed as a Malware-as-a-Service (MaaS) product via cybercrime markets and Telegram channels, characterized by security researchers as a low-cost .NET stealer. The malware is delivered through a sophisticated multi-stage infection chain: victims are lured to download trojanized Electron desktop applications hosted on GitHub repositories (notably claude5opus/Claude-Opus-5-Free-Desktop, impersonating Anthropic's Claude Opus 5 AI model) or game-cheat-themed websites promoted through at least 17 hijacked YouTube channels. Distribution also occurs via fake CAPTCHA pages, fake-error lures, and software impersonating Slack, qBittorrent, Steel Series GG, and Blender.

REVSTEALER employs a novel Chrome App-Bound Encryption bypass technique: it launches the browser process under debugger control, locates code associated with App-Bound decryption, sets a hardware breakpoint nearby, and reads the decrypted key directly from browser memory when the breakpoint triggers. This implementation was likely influenced by the public ElevationKatz project (under ChromeKatz). The malware also uses a Polygon blockchain dead drop mechanism (EtherHiding technique) — each build contains a primary C2 address AND a Polygon smart-contract address. If the primary C2 is unreachable, the malware queries up to five public Polygon JSON-RPC endpoints (polygon-bor-rpc.publicnode.com, polygon.lava.build, polygon.drpc.org, etc.), reads data from the contract using a specific function selector (e.g., 0xdbefdad6, 0xd21368b4), and decrypts the fallback C2 address using AES-256-CBC with an embedded key.

Before execution, REVSTEALER performs extensive anti-analysis checks. A custom 10-test weighted sandbox scoring system evaluates the environment: process blocklist, CPU core count, RAM threshold, GPU/PCI vendor check, username/computer name blocklist, system uptime, sleep/timing check, Media Foundation check, CPUID check, and virtualization check. If the total score reaches 7 or higher, the malware self-terminates. Several checks use a custom FNV-1a hashing algorithm against embedded tables — no plaintext strings appear in the binary. The malware also checks system language and keyboard layout against precomputed FNV-1a hashed values for Commonwealth of Independent States (CIS) locales (Russian, Ukrainian, and several Central Asian languages), terminating if any match. Additional evasion includes a CAPTCHA verification window, payload watermarking (16-byte watermark at EOF requiring a six-character token), VMProtect packing, indirect syscalls (14 syscall wrappers bypassing user-mode API hooks), API hashing, string encryption, and self-deletion after execution.

REVSTEALER targets browser credentials and cookies (via the App-Bound bypass), 225 Chromium extension identifiers (crypto wallets, password managers), 51 standalone cryptocurrency wallet applications, the Windows Credential Manager, 12+ password managers, gaming platforms (Steam with local.vdf/loginusers.vdf, Battle.net, EA Desktop, Roblox cookies decrypted via CryptUnprotectData, Minecraft via multiple launcher paths), VPN/FTP clients, messaging apps, OBS Studio, Windows Sticky Notes, 2FA apps, and documents from user directories and non-system drives. Data is exfiltrated via streaming — encrypted typed records sent directly to the C2 server with no on-disk archive, defeating artifact-based forensics.

Elastic Security Labs recovered four follow-on modules linked to REVSTEALER through shared build tradecraft, same packer, runtime function resolution, and Polygon smart-contract dead drops. ProManager targets cryptocurrency wallets with wallet-file and browser-extension theft, phishing overlays positioned over wallet application windows, password-aware input capture, and payload delivery. WinUpdate monitors the clipboard and replaces copied cryptocurrency addresses with the attacker's address while also collecting text resembling wallet recovery phrases. SoftManager turns the infected machine into a reverse SOCKS5 proxy, routing attacker traffic through the victim's internet connection over encrypted WebSocket. LockAppHost deploys an XMRig cryptocurrency miner with administrator privileges after disabling Windows Update services (5 services, 11 scheduled update tasks, 2 malware removal tasks) and adding Microsoft Defender exclusions for common folders and file types — the miner is hidden within suspended instances of nslookup.exe or svchost.exe. The core stealer deletes itself, so an infection can appear complete while modules continue running. Elastic Security Labs released YARA rules (Windows.Trojan.RevStealer.yar), 9 prevention rules, 1 detection rule, and an IDAPython string decryption script on their public GitHub repositories.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion

Persistence

T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

discovery

T1082 System Information Discovery

command-and-control

T1090 Proxy

Impact

T1496 Resource Hijacking

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Block C2 domains at network perimeter: monitor5.roast-core85[.]click, config.hubdisplay[.]lol, health.journal-metric[.]lol, metric.gardenpark[.]click, meta7[.]archscreen68[.]one, polygon.iwmukj[.]xyz, polygon.mnyhgxda[.]xyz, static4.livelab[.]one, elitecheatsx[.]live, resight-cheats[.]net
• Deploy Elastic YARA rule Windows.Trojan.RevStealer.yar across endpoint detection systems
• Monitor for mutex Global\5B908BC4 as infection indicator
• Search for staging path %USERPROFILE%\AppData.*\*.exe matching known patterns
• Block Polygon JSON-RPC endpoints on non-crypto-development endpoints if not business-required
• Monitor for Windows Defender exclusion additions targeting AppData folders
• Search for suspended nslookup.exe or svchost.exe instances as miner hideout indicator

Workarounds

• Restrict execution of unsigned Electron applications from external sources
• Enable AppLocker or WDAC to block untrusted binaries in AppData paths
• Configure Microsoft Defender to alert on any exclusion changes via audit policy
• Disable Windows Script Host and restrict PowerShell execution policy for non-admin users

Longer-term hardening

• Implement user awareness training on YouTube channel hijacking and game-cheat lures
• Deploy behavioral detection rules for Chrome debugger-based credential access
• Monitor for unexpected browser processes launched with --remote-debugging-port flags
• Implement clipboard monitoring alerts for cryptocurrency address pattern replacement
• Deploy browser policies restricting remote debugging for non-developer users
• Implement session token invalidation policies requiring re-authentication on suspicious activity

Affected and fixed versions

• Microsoft — Windows (all versions)
  Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022
• Google — Chrome
  Vulnerable versions: All versions with App-Bound Encryption
• Microsoft — Edge
  Vulnerable versions: All versions with App-Bound Encryption
• Multiple — Chromium-based browsers
  Vulnerable versions: Brave; Opera; Vivaldi
• Multiple — Cryptocurrency wallets
  Vulnerable versions: 51+ standalone wallet applications; 225+ browser extension wallets
• Multiple — Password managers
  Vulnerable versions: Bitwarden; 1Password; KeePass; LastPass; 12+ total
• Blizzard Entertainment — Battle.net
  Vulnerable versions: All versions
• Valve — Steam
  Vulnerable versions: All versions
• Electronic Arts — EA Desktop
  Vulnerable versions: All versions
• Roblox Corporation — Roblox
  Vulnerable versions: All versions

Timeline

• 2026-02-01 Earliest REVSTEALER sample submitted to VirusTotal, marking the malware's first known appearance in the wild
• 2026-07-01 Gen Threat Labs (Gen Digital / Norton) first publicly documents REVSTEALER, detailing its core features and initial distribution methods
• 2026-08-01 Elastic Security Labs discovers four follow-on modules (ProManager, WinUpdate, SoftManager, LockAppHost) during investigation, linked through shared build tradecraft and Polygon smart contract dead drops
• 2026-08-31 Morphisec Threat Labs publishes deep technical analysis of REVSTEALER's Electron loader, detailing the fake Claude Opus 5 Free Desktop GitHub lure, anti-analysis measures, and streaming exfiltration architecture
• 2026-09-01 Help Net Security and CyberInsider report on the REVSTEALER campaign using the fake Claude Opus 5 Free Desktop app as a distribution vector
• 2026-09-01 Malpedia creates formal entry for win.revstealer malware family, cataloging the Elastic Security Labs analysis as the authoritative reference
• 2026-09-02 The Hacker News publishes analysis of the four follow-on modules, detailing LockAppHost's ability to disable Windows Update and Microsoft Defender while deploying XMRig miner
• 2026-09-02 Elastic Security Labs publishes comprehensive analysis with full technical white paper, YARA rules (Windows.Trojan.RevStealer.yar), IDAPython string decryption script, and 10 detection/prevention rules
• 2026-09-07 Active distribution continues via 17+ hijacked YouTube channels, GitHub repositories, and game-cheat-themed websites; approximately 4,700 total VirusTotal samples accumulated since February 2026

Sources cited

• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-09-07
• REVSTEALER White Paper assets.contentstack.io · Research · 2026-09-02
• Malpedia: win.revstealer malpedia.caad.fkie.fraunhofer.de · Research · 2026-09-01
• Gen Threat Labs first documentation of REVSTEALER genthreatlabs.com · Research · 2026-07-01
• ThreatClaw - REVSTEALER low-cost .NET stealer analysis threatclaw.com · Research · 2026-08-01
• Elastic Security Labs GitHub - YARA rules and detection artifacts GitHub · Code repository · 2026-09-02
• Elastic Security Labs GitHub - IDAPython script and releases GitHub · Code repository · 2026-09-02
• Four REVSTEALER-Linked Modules Disable Windows Update, Microsoft Defender The Hacker News · News · 2026-09-02
• RevStealer malware spreads as fake Claude Opus 5 desktop app Help Net Security · News · 2026-09-01
• New RevStealer Malware Spreads as Fake Claude Opus 5 Desktop App cyberinsider.com · News · 2026-09-01
• REVSTEALER ramps up: analysis of up-and-coming infostealer elastic.co · Analysis · 2026-09-02
• RevStealer: The Infostealer Built to Leave No Trace morphisec.com · Analysis · 2026-08-31

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Fake GlobalProtect MSI Targets Myanmar Using Cloudflare Workers and Google Sheets API as C2 Previous report
• APT-C-60 Spear-Phishing Campaign Delivering SpyGlace via Proton Drive, RAR/LNK and Legitimate Developer Services Next report