REVSTEALER Modular Information Stealer and Persistence Modules

REVSTEALER is a commercial information stealer detected in the wild since February 2026, primarily distributed via malicious game-cheat lures and impersonated AI applications. While the core stealer exfiltrates credentials, browser data, and wallet files before self-deleting, it is often associated with four post-exploitation modules: ProManager, WinUpdate, SoftManager, and LockAppHost. These modules persist in the user profile to perform secondary malicious actions.

Most notably, LockAppHost achieves administrative persistence by abusing the CMSTP tool to disable Windows Update services and Microsoft Defender features. It subsequently deploys a cryptocurrency miner masked within system processes. These modules share tradecraft with the core stealer, including indirect system calls, packer-based obfuscation, and the use of Polygon smart contracts for resilient command-and-control communication. Organizations should prioritize detection of these persistent modules, as the primary stealer may have already completed its execution before security teams identify the compromise.

Attack Chain

1. Initial delivery of REVSTEALER via malicious game-cheat lures or impersonated software installers.
2. Execution of the core stealer using indirect syscalls and anti-sandbox checks to evade security analysis.
3. Exfiltration of credentials, cookies, and sensitive session data to the primary C2 or blockchain-based backup.
4. Deployment of persistent secondary modules (e.g., LockAppHost) into the user profile.
5. Elevation of privileges using CMSTP abuse to gain administrative rights.
6. Disabling of Windows Update services and modification of Microsoft Defender exclusions to weaken system defenses.
7. Execution of a hidden cryptocurrency miner within a suspended instance of legitimate processes like nslookup.exe or svchost.exe.
8. Long-term persistence maintained via Registry Run keys or scheduled tasks for secondary modules.

Impact

Successful infection results in the total loss of credentials, browser cookies, cryptocurrency wallet contents, and messaging data. The persistence modules enable long-term resource hijacking through cryptocurrency mining and proxying, while the weakened security state leaves the machine susceptible to subsequent opportunistic exploitation. Observed activity includes thousands of samples detected in the wild, indicating high-volume distribution targeting end users.

Recommendation

1. Deploy Sigma rules to monitor for unauthorized execution of cmstp.exe for privilege escalation.
2. Hunt for persistence artifacts associated with the identified modules, specifically Registry Run keys and scheduled tasks that execute unsigned binaries in user profile directories.
3. Monitor for Windows Update service status changes or unusual Defender exclusion modifications.
4. Inspect suspended processes (nslookup.exe, svchost.exe) for unexpected malicious threads or memory-resident payloads consistent with crypto-mining.
5. Require password resets and session revocation for any accounts identified on compromised machines due to the theft of session cookies and browser secrets.