Skip to navigation

Threat reportMalwareTL-2026-5625

RevStealer (REF2859) Infostealer Spread via 100+ Domains, Hijacked YouTube Channels and Fake AI/Cheat Tools

highACTIVE

RevStealer is a VMProtect-packed credential stealer distributed through 100+ linked cheat/mod/crack domains, hijacked YouTube channels and trojanized fake software (including a fake Claude Opus 5 desktop app). It steals browser credentials and cookies (including Chrome App-Bound Encryption bypass), game accounts and crypto wallets, and uses a Polygon smart contract (EtherHiding) to resolve a fallback C2. First disclosed .

Key facts

IdentifiersTL-2026-5625
Also known asREVSTEALER, REF2859
SeverityHIGH
First disclosed
Affected productsMicrosoft Windows (consumer and gaming endpoints); Google / Chromium vendors Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) and Firefox credential stores
MITRE ATT&CK techniquesT1005 Data from Local System, T1020 Automated Exfiltration, T1027.007 Dynamic API Resolution, T1070.004 File Deletion, T1082 System Information Discovery, T1090 Proxy, T1102.001 Dead Drop Resolver, T1106 Native API, T1113 Screen Capture, T1140 Deobfuscate/Decode Files or Information, T1204.002 Malicious File, T1480 Execution Guardrails and 8 more in the attack flow
MotivationFINANCIAL
Target sectorsgaming, consumer, content creators, cryptocurrency
Target regionsGlobal
Detection rules9 (1 shown free)
Sources5 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5625 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RevStealer (TL-2026-5625) Defender Exclusion for AppData Folder Set After Lure Execution

Detects Microsoft Defender path exclusions pointing into a user AppData folder, via the registry (Sysmon EID 13) or Add-MpPreference/Set-MpPreference -ExclusionPath PowerShell (Sysmon EID 1). The RevStealer (REF2859) Electron loader decrypts its native payload into a randomly named AppData folder and attempts to add that folder to Defender exclusions (T1562.001, T1204.002) before launching the payload.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1562.001, T1204.002, T1564.003
  • Data sources: sysmon, windows_defender, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=13 TargetObject="*Windows Defender*Exclusions*Paths*" TargetObject="*AppData*") OR (EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="*Add-MpPreference*" OR CommandLine="*Set-MpPreference*") CommandLine="*ExclusionPath*" CommandLine="*AppData*"))
| eval exclusion=coalesce(replace(TargetObject, ".*Paths.", ""), CommandLine)
| stats count min(_time) as first_seen max(_time) as last_seen values(exclusion) as exclusion values(Image) as process values(ParentImage) as parent by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
union
(DeviceRegistryEvents
 | where Timestamp > ago(lookback)
 | where ActionType == "RegistryValueSet"
 | where RegistryKey contains "Windows Defender" and RegistryKey contains "Exclusions" and RegistryKey endswith "Paths"
 | where RegistryValueName contains "AppData"
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine, Exclusion = RegistryValueName),
(DeviceProcessEvents
 | where Timestamp > ago(lookback)
 | where FileName in~ ("powershell.exe", "pwsh.exe")
 | where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference") and ProcessCommandLine has "ExclusionPath" and ProcessCommandLine contains "AppData"
 | project Timestamp, DeviceName, AccountName, Process = FileName, CommandLine = ProcessCommandLine, Exclusion = ProcessCommandLine)
| sort by Timestamp desc

Sigma

title: RevStealer TL-2026-5625 Defender Exclusion for AppData Folder
id: 7c1e5a42-3b0f-4d6a-9a11-5d2f8e0b1c01
status: experimental
description: Detects a Microsoft Defender path exclusion pointing at a folder under AppData, as set by the RevStealer Electron loader (T1562.001) to protect its randomly named payload folder.
references:
    - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
    - https://akatsukilegion.com/post.php?slug=inside-revstealer-s-growing-distribution-ecosystem
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.execution
    - attack.t1204.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Windows Defender\Exclusions\Paths\'
            - '\AppData\'
    filter_main_defender:
        Image|endswith:
            - '\MsMpEng.exe'
            - '\MpCmdRun.exe'
    condition: selection and not filter_main_defender
falsepositives:
    - Administrators or software installers excluding legitimate AppData folders such as developer tools or game launchers
level: high

Known false positives:

  • IT or security administrators adding AppData exclusions for build tools or game launchers
  • Software installers that register their own AppData folders with Defender

Tuning notes: Set index to your Sysmon index. Enable Sysmon registry rules for HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions. Allowlist approved exclusion paths and admin accounts. Tamper protection often blocks the write, so also alert on blocked attempts (Defender events 5007 and 5013).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • RevStealer (TL-2026-5625) Lure, Loader and Module Hash/Filename Execution · unlock with TL Creds
  • RevStealer (TL-2026-5625) Follow-On Modules: ProManager, WinUpdate, SoftManager, LockAppHost/XMRig · unlock with TL Creds
  • RevStealer (TL-2026-5625) Connections to Primary, Sample and Module C2 Hosts · unlock with TL Creds
  • RevStealer (TL-2026-5625) Hidden PowerShell Launched from User-Writable Parent · unlock with TL Creds
  • RevStealer (TL-2026-5625) Non-Browser Process Opens Browser with Memory Access · unlock with TL Creds
  • RevStealer (TL-2026-5625) DNS Resolution of C2 and Distribution Hub Domains · unlock with TL Creds
  • RevStealer (TL-2026-5625) Browser Started Under Control by User-Writable Parent (ABE Bypass) · unlock with TL Creds
  • RevStealer (TL-2026-5625) Non-Browser Process Querying Polygon JSON-RPC Endpoints (EtherHiding) · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5625.

Sample indicators (3 of 29)

  • Domain: elitecheatsx[.]live
  • File hash: 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d
  • Domain: elitemods[.]shop

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

29 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

RevStealer (tracked by Elastic Security Labs as REF2859, with about 4,700 samples seen on VirusTotal over the past year) is a financially motivated infostealer aimed at gamers, content creators and users looking for free or pirated software. Lures include Minecraft, Roblox, Fortnite, Valorant and Counter-Strike 2 cheats and mod menus, Discord Nitro generators, Spotify/Canva premium tools, free VPNs, fake ChatGPT/Grok/DeepSeek/Gemini unlockers, and trojanized Slack, qBittorrent, SteelSeries GG and Blender installers. Morphisec documented a trojanized Electron app impersonating Anthropic's 'Claude Opus 5 Free Desktop', distributed through GitHub repositories and cheat-themed sites (archive of roughly 101 MB). Elastic observed at least 17 YouTube channels, often hijacked, promoting elitecheatsx[.]live and resight-cheats[.]net with AI-generated cheat videos whose descriptions carry the download links.

Execution chain: the victim downloads a ZIP/RAR lure. Stage 1 is VMProtect-packed (Elastic notes the code is largely recoverable by memory dumping), uses WMI and PowerShell and injects into other processes. Stage 2 runs only in memory and a decoy file is dropped. The Electron loader runs hidden, checks for at least 2 GiB RAM, 2 logical cores, a hostname/username blocklist and a recognized GPU, uses a debugger-statement timing check, decrypts an AES-256-CBC resource into a randomly named AppData folder, launches the native payload hidden and detached, and attempts to add the folder to Microsoft Defender exclusions. The native payload FNV-1a-hashes the system language, default language and keyboard layout and exits on a CIS/Central Asian locale match, runs a ten-check weighted sandbox score (process blocklist, CPU count, RAM, GPU/PCI vendor, username/computer name, uptime, sleep timing, Media Foundation, CPUID, virtualization; a virtual graphics adapter counts double) and exits at a score of 7 or higher, resolves APIs without an import table (FNV-1a hashing) and calls the kernel via 14 indirect syscall wrappers, and registers a vectored exception handler so a failing collector does not end the session. Some raw builds require a six-character token and carry a 16-byte end-of-file watermark.

Collection: Chrome, Edge, Brave, Firefox, Opera and Vivaldi passwords, cookies and history; 225 Chromium password-manager extensions; 51 standalone wallet/password apps; VPN, FTP, OBS, Sticky Notes and 2FA tools; Windows Credential Manager; Steam, Roblox, Battle.net, EA Desktop, Battlestate Games and many Minecraft launcher account files; clipboard, screenshots and selected documents. To defeat Chrome App-Bound Encryption it launches a Chromium process under debugger control, locates the App-Bound decryption code, sets a hardware breakpoint nearby and reads the decrypted key from browser memory (Elastic assesses this was likely influenced by the public ElevationKatz/ChromeKatz project). Encrypted typed records are streamed to the C2 over HTTPS/443 and the malware self-deletes after the theft burst; Morphisec reports no persistence for the core implant.

C2 and tasking: each build embeds a primary C2 plus a Polygon smart-contract address and function selector. If the primary is down, it queries up to five public Polygon JSON-RPC endpoints, reads the contract data and AES-decrypts a fallback C2 address (EtherHiding / dead drop resolver), allowing infrastructure rotation without rebuilding the malware. The C2 can deliver four follow-on modules: ProManager (wallet/extension theft, phishing overlays, input capture, payload delivery), WinUpdate (crypto-address replacement, mnemonic clipboard theft), SoftManager (reverse SOCKS5 proxy/backconnect over encrypted WebSocket) and LockAppHost (XMRig deployment, competitor suspension, persistence). The Cyber Security News write-up of the Akatsuki Legion report also notes the operator can push ransomware through the same channel; this claim is not corroborated in the Elastic report.

Distribution ecosystem (Akatsuki Legion, 9 Nov 2026): four hub domains (elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, cheatseller[.]com) share image resources; two resource hashes link to about 70 and about 30 domains, expanding to roughly 100 potentially related domains. Akatsuki Legion states these do not establish direct involvement, that not every domain is confirmed to spread RevStealer, and that one cluster (hash f6be9f1e...) shows only preliminary similarity to REMCOS RAT. Operators appear financially motivated; no nation-state link has been confirmed and no named actor is attributed. Operational timeline per Akatsuki Legion: 2025 Q3 initial infrastructure, 2025 Q4 expansion to 100+ domains, 2026 Q1 fake Claude AI campaign, 2026 Q2 blockchain C2 fallback documented, 2026 Q3 continued growth.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Exfiltration

T1020 Automated Exfiltration

Defense Evasion

T1027.007 Dynamic API Resolution; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1497.003 Time Based Checks; T1564.003 Hidden Window; T1622 Debugger Evasion

Discovery

T1082 System Information Discovery

Command and Control

T1090 Proxy; T1102.001 Dead Drop Resolver; T1568 Dynamic Resolution

Execution

T1106 Native API; T1204.002 Malicious File

Impact

T1496.001 Compute Hijacking

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

  • Block the hub, C2 and related distribution domains listed in the IOCs at DNS/proxy
  • Hunt for non-browser processes connecting to public Polygon JSON-RPC endpoints (polygon-rpc.com, rpc.ankr.com, polygon-mainnet.infura.io, polygon-mainnet.g.alchemy.com, matic-mainnet.chainstacklabs.com, rpc-mainnet.matic.network)
  • Hunt for new Microsoft Defender exclusions pointing at randomly named folders under AppData
  • Reset passwords, revoke browser sessions/cookies and rotate game, Discord and crypto-wallet credentials on any affected host; move wallet funds to new seeds

Workarounds

  • Avoid game cheats, cracked software and unofficial AI tool downloads; obtain software only from official vendor sites
  • Use hardware security keys/passkeys and avoid storing wallet seeds or passwords in the browser

Longer-term hardening

  • Block or restrict execution of unsigned downloads and archives from the Downloads folder via application control
  • Alert on browser processes spawned from unusual parents or started under a debugger (hardware-breakpoint ABE bypass)
  • Enforce tamper protection on Microsoft Defender and audit exclusion changes
  • Train users and gamers on cheat, crack and fake AI tool risks and on spotting hijacked YouTube channels that suddenly change topic
  • Deploy EDR with behavioral rules for shellcode execution from low-reputation modules

Affected and fixed versions

  • Microsoft — Windows (consumer and gaming endpoints)
    Vulnerable versions: Windows systems where users run untrusted cheat/crack/fake-software downloads
  • Google / Chromium vendors — Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi) and Firefox credential stores
    Vulnerable versions: Credential and cookie stores targeted, including Chrome App-Bound Encryption keys

Timeline

  • Akatsuki Legion places initial RevStealer distribution infrastructure in 2025 Q3 (source gives quarter-level only; date is the quarter start)
  • Distribution expands to 100+ domains in 2025 Q4 per Akatsuki Legion (quarter-level; date is the quarter start)
  • Fake Claude AI campaign identified in 2026 Q1 per Akatsuki Legion (quarter-level; date is the quarter start)
  • Blockchain (Polygon EtherHiding) C2 fallback mechanisms documented in 2026 Q2 per Akatsuki Legion (quarter-level; date is the quarter start)
  • Continued infrastructure growth in 2026 Q3 per Akatsuki Legion (quarter-level; date is the quarter start)
  • Morphisec Threat Labs publishes its analysis of RevStealer, covering the trojanized Electron loader (including the fake 'Claude Opus 5 Free Desktop' lure), anti-analysis checks and Polygon fallback C2
  • Elastic Security Labs publishes its REVSTEALER (REF2859) analysis: about 4,700 samples over the past year, 17+ YouTube channels promoting locked-ioc-24 and locked-ioc-22, ABE bypass via hardware breakpoints, four C2-delivered modules and IOCs
  • Detection rules referenced in the Akatsuki Legion report are dated 2026-11-03
  • Akatsuki Legion publishes its report tying the four hub domains and about 100 related domains to shared resources and hosting, and notes a possible REMCOS RAT-related cluster
  • Cyber Security News reports RevStealer's spread via 100+ domains, hijacked YouTube channels and fake AI/cheat tools

Sources cited

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats