Revstealer Credential Harvesting Infostealer

Elastic Security Labs deep dives into REVSTEALER, an emerging infostealer targeting browsers, wallets, and gaming accounts.

Elastic Security Labs is tracking an emerging infostealer, REVSTEALER, under REF2859. This family has gained momentum in recent months, with higher distribution volume, and has emerged as a formidable threat, featuring a comprehensive credential harvester, an embedded sandbox scoring system, and a Polygon blockchain-based dead drop for resilience. Beyond credential theft, REVSTEALER targets gaming platforms for additional monetization; the developer clearly understands that victim accounts on these platforms hold real monetary value in resale markets.

Gen Threat Labs first covered REVSTEALER earlier this summer, detailing its core features. In this research publication, we will walk through how it’s distributed, cover its main features, and observed infrastructure. For readers who prefer more in-depth technical details on the malware, we are also releasing a whitepaper covering the family. We are also releasing an IDAPython string decryption script for anyone working with samples directly.

The white paper is located here and contains an in-depth analysis of REVSTEALER and REF2859.

Large volume of samples (~4700) on VirusTotal over the past year, with varied submission context

Comprehensive stealer component targeting browsers, VPN/chat applications, password managers, gaming platforms. Includes ABE debugger-based bypass.

Weighted anti-analysis checks (sandbox scoring system)

EtherHiding - Polygon-based dead drop for resilient infra swapping

Tasking delivers four modules, not previously documented publicly

Widespread use of VMProtect packer in most REVSTEALER samples; unpacked samples display a verification prompt similar to LummaStealer and AuraStealer

Gen Threat Labs documented REVSTEALER reaching victims through a social-engineering path targeting gamers by advertising free cheats and mod menus. Building on this reporting, we identified at least 17 YouTube channels promoting the two related domains elitecheatsx[.]live and resight-cheats[.]net .

Malicious link in a YouTube video description

Compromised YouTube account

The game-cheat campaign is only one observed presentation. Related VirusTotal submissions used names and file metadata that impersonated unrelated, recognizable software, including Slack, qBittorrent, Steel Series GG, Blender, and many more. This breadth suggests the builds are packaged for multiple lure themes, not just gaming-focused campaigns. We also ran a Retrohunt with our YARA rule, which returned 4,700 matching samples across VirusTotal’s database over the past year.

Retrohunt matches visualized by submission first seen date

Many of the samples we analyzed were packed with VMProtect, but the malware code was mostly recoverable through memory dumping.

Across its design, REVSTEALER reflects a developer building for long-term operational use. The malware incorporates features such as self-deletion, indirect syscalls, API hashing, string encryption, mechanisms to avoid user-mode hooks, and custom exception handling.

An indirect syscall dispatcher

Unlike most commodity stealers, REVSTEALER seems to put more effort into validating its targets; this is evident in its cryptocurrency wallet harvester, which uses a multi-layer architecture with a discovery engine followed by a collector that applies wallet-specific extension filters to extract only relevant files.

Before REVSTEALER qualifies the victim machine, it first checks the machine's default/system languages and keyboard layout using a custom FNV-1a hash lookup. It retrieves each value from the machine, hashes it, and compares it against an embedded table of precomputed values representing the Commonwealth of Independent States (CIS) locales. If any of these three checks match, the malware terminates.

Exclusion checks based on language and keyboard layout

Sandbox scoring system

To determine whether the malware is running in a genuine environment, REVSTEALER integrates a custom sandbox scoring system using ten checks. Each check assigns a specific number of points based on sandbox characteristics such as low total physical RAM or CPU core counts.

If the total score is 7 or higher, the malware determines the machine is likely running in a sandbox environment and then self-terminates.

Sandbox threshold comparison

The following checks are used in this feature:

Process Blocklist (Type 0)

CPU Core Count (Type 1)

RAM Threshold (Type 2)

GPU / PCI Vendor Check (Type 3)

Username / Computer Name Blocklist (Type 4)

System Uptime (Type 5)

Sleep / Timing Check (Type 6)

Media Foundation Check (Type 7)

Virtualization Check (Type 9)

Several of these checks hash values such as process names or usernames using a custom FNV-1a hash algorithm and compare the result against an embedded table. This method ensures no plaintext strings appear in the binary and prevents static analysis tools from seeing them.

Credential harvesting

REVSTEALER targets browser credentials and cookies, cryptocurrency wallets, and browser extensions. This includes 225 Chromium extension identifiers spanning cryptocurrency wallets and password managers, alongside 51 standalone wallet applications. It also collects data from messaging clients, gaming platforms, VPNs, FTP clients, OBS Studio, Windows Sticky Notes, and 2FA applications, along with selected documents and configuration files from user directories and non-system drives.

REVSTEALER’s Chromium support includes an implementation for bypassing App-Bound Encryption. To obtain the App-Bound key, it launches a browser process under debugger control, locates code associated with App-Bound decryption, and sets a nearby hardware breakpoint. When the breakpoint triggers, the malware reads the decrypted key directly from the browser’s memory. The implementation was likely influenced by the public ElevationKatz project (under ChromeKatz ).

Example of decrypted App-Bound key in memory

The developer places a 16-byte watermark at the end of raw payloads and validates it at runtime. Packed builds do not trigger the check because the watermark is no longer located at EOF. When a watermarked raw copy is launched, a verification window requires the user to enter a random six-character token in order to proceed with execution. This discourages distribution of unprotected payloads while also hindering sandbox analyses. Similar techniques have been observed in Lumma Stealer and AuraStealer.

Polygon dead drops as fallback

Each REVSTEALER build contains a primary C2 address and a Polygon smart-contract address. If the primary server is unavailable, REVSTEALER queries up to 5 public Polygon JSON-RPC endpoints, reads data from the contract, and decrypts a fallback C2 address using an embedded AES key.

Below are examples of extracted C2 hosts and Polygon dead drop configurations from three REVSTEALER samples with different themes.

Looking up one of the contract addresses on OKLink, there is an initial transaction to create a Polygon contract (bytecode prefix 0x60806040 ), initialized with an encrypted fallback C2 endpoint.

Polygon C2 transaction

Before any stealing components are launched, REVSTEALER profiles the victim machine, collecting the following data:

REVSTEALER has a deliberate focus on gaming platforms, harvesting sensitive materials, authentication tokens, and session cookies from popular platforms such as Blizzard’s Battle.net, EA Desktop, and Steam, along with targeting specific games such as Roblox and Minecraft. Instead of broadly sweeping the entire victim machine, the malware targets file paths, looking for configuration/settings files for each platform/game. For some of these targets, such as Roblox, REVSTEALER uses CryptUnprotectData to decrypt the user’s session cookie, enabling full account takeover without the user’s password.

Polygon transaction creating the REVSTEALER dead drop contract holding an encrypted fallback C2 address

The following table lists the gaming targets and their paths:

REVSTEALER can receive additional executable content through C2 tasks. We recovered four related, self-contained payloads that extend its capabilities beyond credential theft.

Despite their distinct roles, all four REVSTEALER modules follow a common design pattern: obfuscated configuration, VMProtect-style protection, and Polygon smart contracts used as dead drops for replaceable settings, including C2 endpoints and XMRig’s command line.

REVSTEALER technical white paper

Elastic Security Labs presents a comprehensive technical analysis of REVSTEALER, covering its full capabilities, network communications, anti-analysis, sandbox scoring system, EtherHiding techniques, and follow-on modules.

You can find the technical white paper here .

String decryption script for REVSTEALER in IDA Pro

Using the nightMARE framework, our team is releasing an IDAPython script available for download here . This tool can place decrypted strings in the IDA Pro decompiler to help analysts pinpoint the malware’s functionality.

REVSTEALER and MITRE ATT&CK

Elastic uses the MITRE ATT&CK framework to document common tactics, techniques, and procedures that threats use against enterprise networks.

Tactics represent the why of a technique or sub-technique. It is the adversary’s tactical goal: the reason for performing an action.

Techniques represent how an adversary achieves a tactical goal by performing an action.

Automated Exfiltration

Credentials from Password Stores: Credentials from Web Browsers

File and Directory Discovery

Indicator Removal: File Deletion

System Information Discovery

User Execution: Malicious File

Virtualization/Sandbox Evasion: Time Based Checks

Web Service: Dead Drop Resolver

Detecting and preventing REVSTEALER

Detection rules for REVSTEALER

Network Activity to a Suspicious Top Level Domain

Prevention rules for REVSTEALER

Shellcode Execution from Low Reputation Module

VirtualAlloc API Call from an Unsigned DLL

Network Library Load via LdrLoadDLL

DNS Query to Suspicious Top Level Domain

Potential Evasion with Hardware Breakpoints

Remote Thread Context Manipulation

Potential Browser Information Discovery

Suspicious Remote Process Suspend Activity

Browser Process Spawned from an Unusual Parent

YARA rules for REVSTEALER

Elastic Security has created YARA rules to identify this activity.

Windows.Trojan.RevStealer.yar

Observables and indicators of compromise

This research discusses the following observables.

All observables are also available for download .

The following were referenced throughout the above research:

Gen Threat Labs REVSTEALER coverage on X

Gen Threat Labs REVSTEALER coverage on X

How to correlate Kubernetes audit logs with container runtime data

Linux Detection Engineering - Fileless Execution

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Exploring the Hugging Face Breach: mapping AI agent tactics to Elastic Defend

Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace