New Malware Disables Windows Defender, Installs Miner After Stealing Data

Elastic Security Labs has identified four previously undocumented programs tied to REVSTEALER, a commercial Windows information stealer, that stay behind on compromised systems after the main malware erases itself. One of those programs, called LockAppHost, disables Windows Update and Microsoft Defender before installing a cryptocurrency miner. The company released its findings on September 2 alongside a technical white paper, naming the four programs ProManager, WinUpdate, SoftManager, and LockAppHost.

REVSTEALER has been available for purchase as a commercial infostealer since at least February 2026, when the first sample appeared on VirusTotal. The main stealer grabs browser passwords and cookies, cryptocurrency wallets, gaming accounts, messaging data, and files, then sends a "complete" status to its server, deletes itself, and leaves no trace. The four newly documented programs behave differently—each installs itself into the user's profile and remains there. Elastic recovered the four programs from the same investigation that uncovered REVSTEALER and determined they share its build characteristics, including the same packer, runtime function resolution, and use of Polygon smart contracts for backup configuration. The main stealer can also download and execute additional files from the command line. Elastic didn't observe any of the four programs being delivered to a live REVSTEALER host, so the link depends on shared code and investigative context rather than a witnessed handoff. The company calls the components an "activity set" and notes they're separate executables, not plug-ins loaded into the stealer itself. Elastic's detection rule matched roughly 4,700 samples on VirusTotal over the past year—a tally of files, not confirmed infections.

According to Elastic's account, ProManager steals wallet files and browser wallet extensions, displays attacker-controlled content over a wallet application's window, and logs passwords typed or pasted into fields it identifies as password or passphrase inputs. WinUpdate monitors the clipboard, swaps copied cryptocurrency addresses with the attacker's, and collects text that resembles a wallet recovery phrase. SoftManager converts the machine into a reverse proxy that routes the attacker's network traffic through the victim's connection. LockAppHost runs a cryptocurrency miner with administrator rights after disabling Windows Update and excluding folders from Microsoft Defender. LockAppHost is the most harmful of the four. To obtain administrator rights, it exploits the Windows CMSTP tool, reverting to a standard elevation prompt if that fails. Once elevated, it adds Microsoft Defender exclusions for common folders and file types, disables five Windows Update services, disables 11 scheduled update tasks and two malware removal tasks, and then conceals a miner within legitimate Windows processes. The alterations it makes to weaken the machine's defenses remain after the miner is discovered. ProManager targets users of desktop cryptocurrency wallets—because most of those wallets are built with the Electron framework, ProManager reads the wallet window's saved position and opens attacker-supplied content sized and positioned to overlay the real wallet, without touching the wallet program itself.

Before the modules ever arrive, REVSTEALER casts a wide net. It collects browser passwords and cookies; files from more than 50 cryptocurrency wallets and a large set of wallet browser extensions; session data from Telegram and other messaging clients; VPN and FTP configuration; the Windows Credential Manager; password managers; and selected documents. For some gaming platforms, it goes further—it decrypts the stored Roblox session cookie, letting an attacker take over the account without the password. To obtain credentials that Chrome protects with App-Bound Encryption, REVSTEALER launches the browser in a debugger and reads the decryption key from memory. REVSTEALER reaches victims mainly through game-cheat lures. Elastic identified at least 17 YouTube channels, many hijacked from their original owners, that promoted two cheat websites using short AI-generated videos. The malware has also been packaged as pirated or impersonated software, including a fake "Claude Opus 5 Free Desktop" application that Morphisec documented on August 31. That application copied Anthropic's branding, and there's no indication Anthropic itself was compromised. REVSTEALER is built to resist analysis—it scores the machine against 10 sandbox checks and stops if the total is too high, and it terminates on systems set to one of 10 languages used across Russia and Central Asia.

To reduce the risk of infection, the report advises avoiding "free" or unofficial versions of paid AI tools and game cheats, and installing Claude only from Anthropic's official channels. Elastic has published YARA rules, behavior rules, and a set of indicators for detection and blocking. The public YARA file covers the core stealer and the ProManager, SoftManager, and WinUpdate modules, but doesn't include a rule for LockAppHost, the mining module. Because the core stealer deletes itself, an infection can appear complete while the modules continue running. Where LockAppHost has run, responders should re-enable the Windows Update services and scheduled tasks it turned off, remove the Microsoft Defender exclusions it added, and look for a miner hidden in a suspended instance of nslookup.exe or svchost.exe. Since the stealer takes session cookies and the Chrome App-Bound Encryption key, affected users should change passwords and end active sessions on their accounts rather than assume a password reset is enough. The combination of self-deleting core malware with persistent secondary modules shifts the burden onto defenders who may mistake cleanup for completion, particularly when legitimate system processes become unwitting hosts for hidden miners.