Loading story…
REVSTEALER, an emerging commodity infostealer also tracked as REF2859, is targeting gamers through compromised YouTube channels that promote fraudulent game cheats and mod menus. The malware harvests browser credentials and cookies, messaging and gaming-platform data, documents, screenshots, clipboard contents, and standalone and browser-extension cryptocurrency wallets. It can bypass Chromium App-Bound Encryption by launching browsers under debugger control and extracting data from memory, while VMProtect packing, indirect syscalls, API hashing, CIS locale checks, and sandbox scoring impede analysis.
The malware uses a primary command-and-control server and Polygon smart-contract dead drops to retrieve fallback C2 infrastructure. Its modular ecosystem supports wallet theft, clipboard address hijacking, phishing overlays, SOCKS5 reverse proxying, payload delivery, persistence, and XMRig cryptomining. Auxiliary components—LockAppHost, SoftManager, WinUpdate, and ProManager—can remain after the primary stealer deletes itself, disable Windows security controls, and prolong access, making infected endpoints harder to detect and remediate.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs published an analysis of REVSTEALER, tracked internally as REF2859. The report documented its Polygon smart-contract dead-drop C2 mechanism, cryptocurrency-wallet harvesting, Chromium App-Bound Encryption bypass, and auxiliary modules for phishing overlays, proxying, persistence, clipboard hijacking, and XMRig mining.
REVSTEALER, a Windows information stealer, was reportedly made commercially available. It is designed to steal browser credentials and cookies, messaging data, cryptocurrency-wallet information, files, and gaming-account data.
A REVSTEALER campaign distributed a fake Claude desktop download, ClaudeOpus5-desktop.zip, through the GitHub repository claude5opus/Claude-Opus-5-Free-Desktop. The analyzed Electron-based loader, XabivSystem.exe, could launch a hidden credential stealer and attempted to add the user's AppData directory to Microsoft Defender exclusions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourcecyberveille.ch
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A trojanized GitHub project advertising a free **“Claude Opus 5 Free Desktop”** client is distributing the Windows-based **RevStealer** information stealer. The malicious Electron application performs host profiling and anti-analysis checks before decrypting a native payload into a randomly named `AppData` directory; the payload adds anti-VM scoring, regional targeting exclusions, and a CAPTCHA gate. Operators have also used game-cheat-themed websites to deliver the malware, demonstrating reuse across multiple social-engineering lures. RevStealer targets browser passwords, cookies and sessions, cryptocurrency wallets, password-manager data, VPN and remote-access settings, messaging and gaming artifacts, screenshots, clipboard contents, and selected documents. It seeks to minimize forensic traces through runtime decryption, import-less API resolution, indirect syscalls, encrypted streaming exfiltration, attempted Microsoft Defender exclusions, and self-deletion rather than persistence. When its primary command-and-control infrastructure is unavailable, the malware can obtain fallback C2 details from a Polygon smart contract.
Sep 7, 2026
**Stealc**, a malware-as-a-service Windows information stealer advertised on Russian-speaking cybercrime forums in January 2023, rapidly gained criminal adoption. The malware borrows capabilities and design elements from Vidar, Raccoon, Mars, and RedLine, stealing browser credentials and cookies, cryptocurrency-wallet data, desktop-wallet files, and information from Discord, Telegram, Outlook, Steam, and Tox. Researchers observed more than 40 samples and at least 35 active command-and-control servers, with campaigns using YouTube videos and cracked-software downloads as lures. Stealc uses RC4 and Base64 string obfuscation, dynamic API resolution, sandbox checks, staged C2 tasking, and self-deletion following exfiltration. It is part of a broader active ecosystem of Windows stealers including RedLine, MetaStealer, and Agent Tesla: RedLine dominated observed telemetry during 2022–2023, while Agent Tesla activity increased through 2024. Defenders should prioritize detection of suspicious access to browser credential stores and cryptocurrency-wallet files, as well as unsigned executables communicating with Telegram or Discord infrastructure.
Sep 9, 2026
Researchers detailed the **StealC** infostealer as a growing malware family sold on underground forums and operated through self-hosted PHP-based panels, with public and customized private variants reportedly available to customers. Reverse-engineering reports show StealC using anti-analysis checks, dynamic API resolution, and layered string protection including **RC4+Base64** and **XOR** decryption, while packed samples used the `pkr_ce1a` loader with **TEA-based** decryption and anti-emulation logic. Analysts also published tooling and detection content, including YARA coverage, IDA and Binary Ninja automation, and configuration extraction methods that help recover embedded indicators from samples. The malware was shown stealing browser credentials, application logins, cryptocurrency wallet data, system information, plugins, and selected files before exfiltrating the data over **HTTP** in multipart requests. Multiple analyses tied samples to command-and-control infrastructure including `185.172.128.59` serving `ISetup8.exe`, `185.172.128.150` with the path `/b7d0cfdb1d966bdd/c698e1bc8a2f5e6d.php`, and `94.131.107.238` with `/3aa13fff14e398a1.php`; one observed sample also downloaded and executed a **Laplas Clipper** as a next-stage payload. The combined findings indicate that StealC remains an adaptable credential-theft platform with evolving packing, configurable infrastructure, and support for follow-on malware delivery.
Aug 15, 2026