Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Elastic Security Labs documents four programs associated with REVSTEALER, a Windows information stealer, that remain on infected machines after the stealer deletes itself.
Intelligence analysis by Qwen 2.5 (3B)
Elastic Security Labs has found four programs linked to REVSTEALER, a Windows information stealer, that persist on infected machines. One of them disables Windows Update and Defender to run a crypto miner.
Four programs linked to a bad guy's spyware (REVSTEALER) stay on your computer even after the spyware tries to delete itself. One of these programs stops your computer from getting updates and security checks, so a bad guy can run a coin-making machine.
Analysis
{"heading_1":"The REVSTEALER Infostealer and Its Modules","paragraph_1":"REVSTEALER is an emerging Windows information stealer that has been sold as a commercial product since February 2026. It exfiltrates various types of data and deletes itself after completing the exfiltration process.","paragraph_2":"Elastic Security Labs has documented four additional programs associated with REVSTEALER, which remain on an infected machine after the stealer deletes itself. These programs are named ProManager, WinUpdate, SoftManager, and LockAppHost.","paragraph_3":"ProManager steals wallet files and browser wallet extensions, displays attacker-controlled content over a wallet application's window, and logs passwords typed or pasted into fields it identifies as password or passphrase inputs."}
Key points
- Elastic Security Labs found four programs linked to REVSTEALER, a Windows information stealer.
- One of these programs disables Windows Update and Defender to run a crypto miner.
- REVSTEALER has been sold as a commercial product since February 2026.
The discovery of these modules can help improve security measures to detect and prevent such attacks.
The persistence of these modules and their ability to disable security features pose a significant threat to computer security.
