# RevStealer (REF2859) Infostealer Spread via 100+ Domains, Hijacked YouTube Channels and Fake AI/Cheat Tools

> RevStealer is a VMProtect-packed credential stealer distributed through 100+ linked cheat/mod/crack domains, hijacked YouTube channels and trojanized fake software (including a fake Claude Opus 5 desktop app). It steals browser credentials and cookies (including Chrome App-Bound Encryption bypass), game accounts and crypto wallets, and uses a Polygon smart contract (EtherHiding) to resolve a fallback C2.

- **Published:** 2026-11-10T07:45:05Z
- **Last reviewed:** 2026-11-10T07:45:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5625
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5625.png
- **ID:** TL-2026-5625
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

RevStealer (tracked by Elastic Security Labs as REF2859, with about 4,700 samples seen on VirusTotal over the past year) is a financially motivated infostealer aimed at gamers, content creators and users looking for free or pirated software. Lures include Minecraft, Roblox, Fortnite, Valorant and Counter-Strike 2 cheats and mod menus, Discord Nitro generators, Spotify/Canva premium tools, free VPNs, fake ChatGPT/Grok/DeepSeek/Gemini unlockers, and trojanized Slack, qBittorrent, SteelSeries GG and Blender installers. Morphisec documented a trojanized Electron app impersonating Anthropic's 'Claude Opus 5 Free Desktop', distributed through GitHub repositories and cheat-themed sites (archive of roughly 101 MB). Elastic observed at least 17 YouTube channels, often hijacked, promoting elitecheatsx[.]live and resight-cheats[.]net with AI-generated cheat videos whose descriptions carry the download links.

Execution chain: the victim downloads a ZIP/RAR lure. Stage 1 is VMProtect-packed (Elastic notes the code is largely recoverable by memory dumping), uses WMI and PowerShell and injects into other processes. Stage 2 runs only in memory and a decoy file is dropped. The Electron loader runs hidden, checks for at least 2 GiB RAM, 2 logical cores, a hostname/username blocklist and a recognized GPU, uses a debugger-statement timing check, decrypts an AES-256-CBC resource into a randomly named AppData folder, launches the native payload hidden and detached, and attempts to add the folder to Microsoft Defender exclusions. The native payload FNV-1a-hashes the system language, default language and keyboard layout and exits on a CIS/Central Asian locale match, runs a ten-check weighted sandbox score (process blocklist, CPU count, RAM, GPU/PCI vendor, username/computer name, uptime, sleep timing, Media Foundation, CPUID, virtualization; a virtual graphics adapter counts double) and exits at a score of 7 or higher, resolves APIs without an import table (FNV-1a hashing) and calls the kernel via 14 indirect syscall wrappers, and registers a vectored exception handler so a failing collector does not end the session. Some raw builds require a six-character token and carry a 16-byte end-of-file watermark.

Collection: Chrome, Edge, Brave, Firefox, Opera and Vivaldi passwords, cookies and history; 225 Chromium password-manager extensions; 51 standalone wallet/password apps; VPN, FTP, OBS, Sticky Notes and 2FA tools; Windows Credential Manager; Steam, Roblox, Battle.net, EA Desktop, Battlestate Games and many Minecraft launcher account files; clipboard, screenshots and selected documents. To defeat Chrome App-Bound Encryption it launches a Chromium process under debugger control, locates the App-Bound decryption code, sets a hardware breakpoint nearby and reads the decrypted key from browser memory (Elastic assesses this was likely influenced by the public ElevationKatz/ChromeKatz project). Encrypted typed records are streamed to the C2 over HTTPS/443 and the malware self-deletes after the theft burst; Morphisec reports no persistence for the core implant.

C2 and tasking: each build embeds a primary C2 plus a Polygon smart-contract address and function selector. If the primary is down, it queries up to five public Polygon JSON-RPC endpoints, reads the contract data and AES-decrypts a fallback C2 address (EtherHiding / dead drop resolver), allowing infrastructure rotation without rebuilding the malware. The C2 can deliver four follow-on modules: ProManager (wallet/extension theft, phishing overlays, input capture, payload delivery), WinUpdate (crypto-address replacement, mnemonic clipboard theft), SoftManager (reverse SOCKS5 proxy/backconnect over encrypted WebSocket) and LockAppHost (XMRig deployment, competitor suspension, persistence). The Cyber Security News write-up of the Akatsuki Legion report also notes the operator can push ransomware through the same channel; this claim is not corroborated in the Elastic report.

Distribution ecosystem (Akatsuki Legion, 9 Nov 2026): four hub domains (elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, cheatseller[.]com) share image resources; two resource hashes link to about 70 and about 30 domains, expanding to roughly 100 potentially related domains. Akatsuki Legion states these do not establish direct involvement, that not every domain is confirmed to spread RevStealer, and that one cluster (hash f6be9f1e...) shows only preliminary similarity to REMCOS RAT. Operators appear financially motivated; no nation-state link has been confirmed and no named actor is attributed. Operational timeline per Akatsuki Legion: 2025 Q3 initial infrastructure, 2025 Q4 expansion to 100+ domains, 2026 Q1 fake Claude AI campaign, 2026 Q2 blockchain C2 fallback documented, 2026 Q3 continued growth.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1106 Native API
- T1497.003 Time Based Checks
- T1480 Execution Guardrails
- T1622 Debugger Evasion
- T1027.007 Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1564.003 Hidden Window
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1102.001 Dead Drop Resolver
- T1568 Dynamic Resolution
- T1090 Proxy
- T1020 Automated Exfiltration
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**RevStealer (TL-2026-5625) Defender Exclusion for AppData Folder Set After Lure Execution** (`TL-2026-5625-SPL-001`)

Detects Microsoft Defender path exclusions pointing into a user AppData folder, via the registry (Sysmon EID 13) or Add-MpPreference/Set-MpPreference -ExclusionPath PowerShell (Sysmon EID 1). The RevStealer (REF2859) Electron loader decrypts its native payload into a randomly named AppData folder and attempts to add that folder to Defender exclusions (T1562.001, T1204.002) before launching the payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1562.001, T1204.002, T1564.003
- **Data sources:** sysmon, windows_defender, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=13 TargetObject="*Windows Defender*Exclusions*Paths*" TargetObject="*AppData*") OR (EventCode=1 (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="*Add-MpPreference*" OR CommandLine="*Set-MpPreference*") CommandLine="*ExclusionPath*" CommandLine="*AppData*"))
| eval exclusion=coalesce(replace(TargetObject, ".*Paths.", ""), CommandLine)
| stats count min(_time) as first_seen max(_time) as last_seen values(exclusion) as exclusion values(Image) as process values(ParentImage) as parent by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
union
(DeviceRegistryEvents
 | where Timestamp > ago(lookback)
 | where ActionType == "RegistryValueSet"
 | where RegistryKey contains "Windows Defender" and RegistryKey contains "Exclusions" and RegistryKey endswith "Paths"
 | where RegistryValueName contains "AppData"
 | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Process = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine, Exclusion = RegistryValueName),
(DeviceProcessEvents
 | where Timestamp > ago(lookback)
 | where FileName in~ ("powershell.exe", "pwsh.exe")
 | where ProcessCommandLine has_any ("Add-MpPreference", "Set-MpPreference") and ProcessCommandLine has "ExclusionPath" and ProcessCommandLine contains "AppData"
 | project Timestamp, DeviceName, AccountName, Process = FileName, CommandLine = ProcessCommandLine, Exclusion = ProcessCommandLine)
| sort by Timestamp desc
```

### Sigma

```yaml
title: RevStealer TL-2026-5625 Defender Exclusion for AppData Folder
id: 7c1e5a42-3b0f-4d6a-9a11-5d2f8e0b1c01
status: experimental
description: Detects a Microsoft Defender path exclusion pointing at a folder under AppData, as set by the RevStealer Electron loader (T1562.001) to protect its randomly named payload folder.
references:
    - https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer
    - https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/
    - https://akatsukilegion.com/post.php?slug=inside-revstealer-s-growing-distribution-ecosystem
author: Threadlinqs Team
date: 2026/11/10
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.execution
    - attack.t1204.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Windows Defender\Exclusions\Paths\'
            - '\AppData\'
    filter_main_defender:
        Image|endswith:
            - '\MsMpEng.exe'
            - '\MpCmdRun.exe'
    condition: selection and not filter_main_defender
falsepositives:
    - Administrators or software installers excluding legitimate AppData folders such as developer tools or game launchers
level: high

```

**Known false positives:**

- IT or security administrators adding AppData exclusions for build tools or game launchers
- Software installers that register their own AppData folders with Defender

**Tuning notes:** Set index to your Sysmon index. Enable Sysmon registry rules for HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions. Allowlist approved exclusion paths and admin accounts. Tamper protection often blocks the write, so also alert on blocked attempts (Defender events 5007 and 5013).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- RevStealer (TL-2026-5625) Lure, Loader and Module Hash/Filename Execution (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Follow-On Modules: ProManager, WinUpdate, SoftManager, LockAppHost/XMRig (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Connections to Primary, Sample and Module C2 Hosts (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Hidden PowerShell Launched from User-Writable Parent (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Non-Browser Process Opens Browser with Memory Access (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) DNS Resolution of C2 and Distribution Hub Domains (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Browser Started Under Control by User-Writable Parent (ABE Bypass) (locked: unlock with TL Creds)
- RevStealer (TL-2026-5625) Non-Browser Process Querying Polygon JSON-RPC Endpoints (EtherHiding) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- Domain: `elitecheatsx[.]live`
- File hash: `251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d`
- Domain: `elitemods[.]shop`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [RevStealer Uses 100+ Domains and Hijacked YouTube Channels to Spread Credential-Stealing Malware](https://cybersecuritynews.com/revstealer-uses-100-domains/)
- [REVSTEALER ramps up: analysis of up-and-coming infostealer (Elastic Security Labs)](https://www.elastic.co/security-labs/threat-command/revstealer-credential-harvesting-infostealer)
- [RevStealer: Silence Is Its Greatest Weapon (Morphisec)](https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/)
- [Inside RevStealer's Growing Distribution Ecosystem (Akatsuki Legion)](https://akatsukilegion.com/post.php?slug=inside-revstealer-s-growing-distribution-ecosystem)
- [Elastic labs-releases: RevStealer indicators and IDAPython string decryption script](https://github.com/elastic/labs-releases)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5625