REVSTEALER (REF2859): Emerging Windows infostealer with App-Bound encryption bypass, Polygon blockchain C2, and gaming-focused social engineering
REVSTEALER (REF2859) (TL-2026-2370), also tracked as REF2859, is a high-severity malware campaign, first published 2026-09-07. It has no confirmed attribution, affects Microsoft Windows (all versions), maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1053), and is covered by 9 detection rules and 28 indicators of compromise.
Key facts for TL-2026-2370
- Threat ID
- TL-2026-2370
- Also known as
- REF2859, REVSTEALER
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-07
- Last reviewed
- 2026-09-07
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gaming, finance, technology, individuals
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in REVSTEALER (REF2859)
Malware and tooling: REVSTEALER, 0x0E04c59f31E382D2B8A1637f4B9A5f04165EC48d, 0x0EC6a6D31b36271eBD06450EA98c84eBa8a191d5, 0x0cF1Ec8B9551103de729c3b02D77221Da9d81Acc, 0x49cE5712164755ed212209bc71539bBc6fCFF541, 0x7e4126ADFE6679B3613F629CD49162Fb08fc53Bd, 0x98FF8e7cdC13AE46b83B7590B986F25f1560DF03, 0xC4eC9B7be1c2A0B39Eca678673DcB9164CA5df53
REVSTEALER is an emerging commercial Windows infostealer first documented by Gen Threat Labs in July 2026 and thoroughly analyzed by Elastic Security Labs (REF2859), Morphisec, and The Hacker News. With approximately 4,700 VirusTotal samples since February 2026, it is distributed via hijacked YouTube channels (17+) and fake software downloads (including a fake Claude Opus 5 Free Desktop app) targeting gamers and users of pirated software. It features a Chrome App-Bound encryption bypass (influenced by ElevationKatz/ChromeKatz), a Polygon blockchain smart-contract dead drop for resilient C2 failover, a 10-test weighted sandbox-scoring anti-analysis system, VMProtect packing, indirect syscalls, and a modular post-exploitation framework with four follow-on modules for cryptocurrency theft, clipboard hijacking, reverse SOCKS5 proxy, and XMRig cryptomining deployment.
How REVSTEALER (REF2859) works
REVSTEALER (tracked by Elastic Security Labs as REF2859) is a commercially sold Windows infostealer that has been active since at least February 2026, when the earliest sample was submitted to VirusTotal. It is distributed as a Malware-as-a-Service (MaaS) product via cybercrime markets and Telegram channels, characterized by security researchers as a low-cost .NET stealer. The malware is delivered through a sophisticated multi-stage infection chain: victims are lured to download trojanized Electron desktop applications hosted on GitHub repositories (notably claude5opus/Claude-Opus-5-Free-Desktop, impersonating Anthropic's Claude Opus 5 AI model) or game-cheat-themed websites promoted through at least 17 hijacked YouTube channels. Distribution also occurs via fake CAPTCHA pages, fake-error lures, and software impersonating Slack, qBittorrent, Steel Series GG, and Blender.
REVSTEALER employs a novel Chrome App-Bound Encryption bypass technique: it launches the browser process under debugger control, locates code associated with App-Bound decryption, sets a hardware breakpoint nearby, and reads the decrypted key directly from browser memory when the breakpoint triggers. This implementation was likely influenced by the public ElevationKatz project (under ChromeKatz). The malware also uses a Polygon blockchain dead drop mechanism (EtherHiding technique) — each build contains a primary C2 address AND a Polygon smart-contract address. If the primary C2 is unreachable, the malware queries up to five public Polygon JSON-RPC endpoints (polygon-bor-rpc.publicnode.com, polygon.lava.build, polygon.drpc.org, etc.), reads data from the contract using a specific function selector (e.g., 0xdbefdad6, 0xd21368b4), and decrypts the fallback C2 address using AES-256-CBC with an embedded key.
Before execution, REVSTEALER performs extensive anti-analysis checks. A custom 10-test weighted sandbox scoring system evaluates the environment: process blocklist, CPU core count, RAM threshold, GPU/PCI vendor check, username/computer name blocklist, system uptime, sleep/timing check, Media Foundation check, CPUID check, and virtualization check. If the total score reaches 7 or higher, the malware self-terminates. Several checks use a custom FNV-1a hashing algorithm against embedded tables — no plaintext strings appear in the binary. The malware also checks system language and keyboard layout against precomputed FNV-1a hashed values for Commonwealth of Independent States (CIS) locales (Russian, Ukrainian, and several Central Asian languages), terminating if any match. Additional evasion includes a CAPTCHA verification window, payload watermarking (16-byte watermark at EOF requiring a six-character token), VMProtect packing, indirect syscalls (14 syscall wrappers bypassing user-mode API hooks), API hashing, string encryption, and self-deletion after execution.
REVSTEALER targets browser credentials and cookies (via the App-Bound bypass), 225 Chromium extension identifiers (crypto wallets, password managers), 51 standalone cryptocurrency wallet applications, the Windows Credential Manager, 12+ password managers, gaming platforms (Steam with local.vdf/loginusers.vdf, Battle.net, EA Desktop, Roblox cookies decrypted via CryptUnprotectData, Minecraft via multiple launcher paths), VPN/FTP clients, messaging apps, OBS Studio, Windows Sticky Notes, 2FA apps, and documents from user directories and non-system drives. Data is exfiltrated via streaming — encrypted typed records sent directly to the C2 server with no on-disk archive, defeating artifact-based forensics.
Elastic Security Labs recovered four follow-on modules linked to REVSTEALER through shared build tradecraft, same packer, runtime function resolution, and Polygon smart-contract dead drops. ProManager targets cryptocurrency wallets with wallet-file and browser-extension theft, phishing overlays positioned over wallet application windows, password-aware input capture, and payload delivery. WinUpdate monitors the clipboard and replaces copied cryptocurrency addresses with the attacker's address while also collecting text resembling wallet recovery phrases. SoftManager turns the infected machine into a reverse SOCKS5 proxy, routing attacker traffic through the victim's internet connection over encrypted WebSocket. LockAppHost deploys an XMRig cryptocurrency miner with administrator privileges after disabling Windows Update services (5 services, 11 scheduled update tasks, 2 malware removal tasks) and adding Microsoft Defender exclusions for common folders and file types — the miner is hidden within suspended instances of nslookup.exe or svchost.exe. The core stealer deletes itself, so an infection can appear complete while modules continue running. Elastic Security Labs released YARA rules (Windows.Trojan.RevStealer.yar), 9 prevention rules, 1 detection rule, and an IDAPython string decryption script on their public GitHub repositories.
MITRE ATT&CK techniques used in TL-2026-2370
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
discovery
T1082 System Information Discovery
command-and-control
Impact
defense-impairment
Affected products and versions in REVSTEALER (REF2859)
- Microsoft — Windows (all versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Google — Chrome
Vulnerable versions: All versions with App-Bound Encryption - Microsoft — Edge
Vulnerable versions: All versions with App-Bound Encryption - Multiple — Chromium-based browsers
Vulnerable versions: Brave; Opera; Vivaldi - Multiple — Cryptocurrency wallets
Vulnerable versions: 51+ standalone wallet applications; 225+ browser extension wallets - Multiple — Password managers
Vulnerable versions: Bitwarden; 1Password; KeePass; LastPass; 12+ total - Blizzard Entertainment — Battle.net
Vulnerable versions: All versions - Valve — Steam
Vulnerable versions: All versions - Electronic Arts — EA Desktop
Vulnerable versions: All versions - Roblox Corporation — Roblox
Vulnerable versions: All versions
Remediation for REVSTEALER (REF2859)
Immediate actions
- Block C2 domains at network perimeter: monitor5.roast-core85[.]click, config.hubdisplay[.]lol, health.journal-metric[.]lol, metric.gardenpark[.]click, meta7[.]archscreen68[.]one, polygon.iwmukj[.]xyz, polygon.mnyhgxda[.]xyz, static4.livelab[.]one, elitecheatsx[.]live, resight-cheats[.]net
- Deploy Elastic YARA rule Windows.Trojan.RevStealer.yar across endpoint detection systems
- Monitor for mutex Global\5B908BC4 as infection indicator
- Search for staging path %USERPROFILE%\AppData.*\*.exe matching known patterns
- Block Polygon JSON-RPC endpoints on non-crypto-development endpoints if not business-required
- Monitor for Windows Defender exclusion additions targeting AppData folders
- Search for suspended nslookup.exe or svchost.exe instances as miner hideout indicator
Workarounds
- Restrict execution of unsigned Electron applications from external sources
- Enable AppLocker or WDAC to block untrusted binaries in AppData paths
- Configure Microsoft Defender to alert on any exclusion changes via audit policy
- Disable Windows Script Host and restrict PowerShell execution policy for non-admin users
Longer-term hardening
- Implement user awareness training on YouTube channel hijacking and game-cheat lures
- Deploy behavioral detection rules for Chrome debugger-based credential access
- Monitor for unexpected browser processes launched with --remote-debugging-port flags
- Implement clipboard monitoring alerts for cryptocurrency address pattern replacement
- Deploy browser policies restricting remote debugging for non-developer users
- Implement session token invalidation policies requiring re-authentication on suspicious activity
Timeline of REVSTEALER (REF2859)
- Earliest REVSTEALER sample submitted to VirusTotal, marking the malware's first known appearance in the wild
- Gen Threat Labs (Gen Digital / Norton) first publicly documents REVSTEALER, detailing its core features and initial distribution methods
- Elastic Security Labs discovers four follow-on modules (ProManager, WinUpdate, SoftManager, LockAppHost) during investigation, linked through shared build tradecraft and Polygon smart contract dead drops
- Morphisec Threat Labs publishes deep technical analysis of REVSTEALER's Electron loader, detailing the fake Claude Opus 5 Free Desktop GitHub lure, anti-analysis measures, and streaming exfiltration architecture
- Help Net Security and CyberInsider report on the REVSTEALER campaign using the fake Claude Opus 5 Free Desktop app as a distribution vector
- Malpedia creates formal entry for win.revstealer malware family, cataloging the Elastic Security Labs analysis as the authoritative reference
- The Hacker News publishes analysis of the four follow-on modules, detailing LockAppHost's ability to disable Windows Update and Microsoft Defender while deploying XMRig miner
- Elastic Security Labs publishes comprehensive analysis with full technical white paper, YARA rules (Windows.Trojan.RevStealer.yar), IDAPython string decryption script, and 10 detection/prevention rules
- Active distribution continues via 17+ hijacked YouTube channels, GitHub repositories, and game-cheat-themed websites; approximately 4,700 total VirusTotal samples accumulated since February 2026
Sources cited for REVSTEALER (REF2859)
- REVSTEALER ramps up: analysis of up-and-coming infostealer
- REVSTEALER White Paper
- RevStealer: The Infostealer Built to Leave No Trace
- Four REVSTEALER-Linked Modules Disable Windows Update, Microsoft Defender
- Malpedia: win.revstealer
- RevStealer malware spreads as fake Claude Opus 5 desktop app
- New RevStealer Malware Spreads as Fake Claude Opus 5 Desktop App
- Gen Threat Labs first documentation of REVSTEALER
- Elastic Security Labs GitHub - YARA rules and detection artifacts
- Elastic Security Labs GitHub - IDAPython script and releases
- ThreatClaw - REVSTEALER low-cost .NET stealer analysis
- CISA Known Exploited Vulnerabilities Catalog
More in malware
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
Detection coverage for TL-2026-2370
As of 2026-09-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2370 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.