RevStealer infostealer uses 14 indirect syscalls and fake AI and cheat lures to steal browser, wallet and gaming credentials
RevStealer (tracked by Elastic Security Labs as REF2859) is a fast-moving Windows infostealer that spreads through gaming-cheat and fake AI tool lures to take browser, cryptocurrency wallet and gaming credentials. Elastic found at least 17 hijacked YouTube channels posting short AI-generated "cheat" demos that link to malicious domains (gbhackers.com). The most notable lure is a fake "Claude Opus 5 Free Desktop" GitHub project impersonating Anthropic, and there is no indication that Anthropic itself was compromised (gbhackers.com). Builds also masquerade as Slack, qBittorrent and SteelSeries GG, so the malware is not limited to gamers (gbhackers.com). RevStealer is a malware family, not a product flaw, so no CVE, CVSS score or vendor patch applies (elastic.co).
Detalhes técnicos
The loader is a windowless 64-bit Electron application in a roughly 101 MB archive. Before it decrypts anything, it checks for at least 2 GiB of RAM and two logical CPU cores, and it inspects the hostname, username and graphics adapter (gbhackers.com). A debugger-timing check wipes its encoded string table if execution pauses for more than about 100 milliseconds (gbhackers.com). The loader then decrypts an AES-256-CBC resource, writes the native payload to a randomly named AppData directory, attempts to add that folder to Microsoft Defender exclusions and launches the payload hidden (gbhackers.com).
The native stage runs a weighted ten-check sandbox score and self-terminates at seven or higher. It also exits on CIS locales and uses a CAPTCHA-style prompt to block fully automated sandboxes (gbhackers.com). It resolves Windows APIs without an import table and reaches the kernel through 14 indirect syscall wrappers, which bypasses the exported functions where user-mode hooks sit (gbhackers.com). Gen Threat Labs found that the syscall numbers come from the index of each ntdll Zw* export, and the wrappers jump through a randomly chosen syscall;ret gadget (gbhackers.com). A vectored exception handler keeps one failed collector from ending the theft (gbhackers.com).
For data theft, the malware targets browser databases, extensions, password managers, VPN and FTP clients, messaging apps and 2FA tools, with 225 Chromium extension identifiers and 51 standalone wallet applications counted (gbhackers.com). Gaming targets include Steam, Battle.net, EA Desktop, Roblox and Minecraft. For Roblox it decrypts the session cookie, which allows account takeover without a password (gbhackers.com). To defeat Chrome App-Bound Encryption, it launches the browser under a debugger, sets a hardware breakpoint and reads the decrypted key from memory, a method Elastic says was likely influenced by the public ElevationKatz project (elastic.co).
Each build embeds a primary C2 address and a Polygon smart-contract address. If the primary server is down, it queries up to five public Polygon RPC endpoints and decrypts a fallback C2 with an embedded AES key, a technique known as EtherHiding (gbhackers.com). Stolen data leaves as encrypted, typed records streamed over HTTPS, after which the malware deletes itself and leaves no persistence (gbhackers.com). Elastic documented four modules delivered through C2 tasking: ProManager (wallet overlays and clipboard address swapping), WinUpdate (a SOCKS5 proxy), SoftManager, and LockAppHost (an XMRig miner that disables Windows Update and Defender) (gbhackers.com). Elastic's YARA retrohunt matched about 4,700 samples on VirusTotal over the past year (elastic.co).
Remediação
Because the theft runs as a single burst, response often arrives too late, so defenders should block downloads from cheat and crack sites and treat unsigned Electron apps from GitHub as suspect (gbhackers.com). Teams should alert on new Defender exclusions in AppData and on Polygon RPC queries from user-writable paths, and Wazuh published a detection rule for the latter (rule 117317) (gbhackers.com). Anyone who ran a suspect build should rotate passwords, revoke sessions and move wallets from a clean device (gbhackers.com).
Linha do tempo
-
RevStealer infostealer uses 14 indirect syscalls and fake AI and cheat lures to steal browser, wallet and gaming credentials
ler a análise desta fonte ocultar
RevStealer (tracked by Elastic Security Labs as REF2859) is a fast-moving Windows infostealer that spreads through gaming-cheat and fake AI tool lures to take browser, cryptocurrency wallet and gaming credentials. Elastic found at least 17 hijacked YouTube channels posting short AI-generated "cheat" demos that link to malicious domains (gbhackers.com). The most notable lure is a fake "Claude Opus 5 Free Desktop" GitHub project impersonating Anthropic, and there is no indication that Anthropic itself was compromised (gbhackers.com). Builds also masquerade as Slack, qBittorrent and SteelSeries GG, so the malware is not limited to gamers (gbhackers.com). RevStealer is a malware family, not a product flaw, so no CVE, CVSS score or vendor patch applies (elastic.co).
Technical Details
The loader is a windowless 64-bit Electron application in a roughly 101 MB archive. Before it decrypts anything, it checks for at least 2 GiB of RAM and two logical CPU cores, and it inspects the hostname, username and graphics adapter (gbhackers.com). A debugger-timing check wipes its encoded string table if execution pauses for more than about 100 milliseconds (gbhackers.com). The loader then decrypts an AES-256-CBC resource, writes the native payload to a randomly named AppData directory, attempts to add that folder to Microsoft Defender exclusions and launches the payload hidden (gbhackers.com).
The native stage runs a weighted ten-check sandbox score and self-terminates at seven or higher. It also exits on CIS locales and uses a CAPTCHA-style prompt to block fully automated sandboxes (gbhackers.com). It resolves Windows APIs without an import table and reaches the kernel through 14 indirect syscall wrappers, which bypasses the exported functions where user-mode hooks sit (gbhackers.com). Gen Threat Labs found that the syscall numbers come from the index of each ntdll Zw* export, and the wrappers jump through a randomly chosen syscall;ret gadget (gbhackers.com). A vectored exception handler keeps one failed collector from ending the theft (gbhackers.com).
For data theft, the malware targets browser databases, extensions, password managers, VPN and FTP clients, messaging apps and 2FA tools, with 225 Chromium extension identifiers and 51 standalone wallet applications counted (gbhackers.com). Gaming targets include Steam, Battle.net, EA Desktop, Roblox and Minecraft. For Roblox it decrypts the session cookie, which allows account takeover without a password (gbhackers.com). To defeat Chrome App-Bound Encryption, it launches the browser under a debugger, sets a hardware breakpoint and reads the decrypted key from memory, a method Elastic says was likely influenced by the public ElevationKatz project (elastic.co).
Each build embeds a primary C2 address and a Polygon smart-contract address. If the primary server is down, it queries up to five public Polygon RPC endpoints and decrypts a fallback C2 with an embedded AES key, a technique known as EtherHiding (gbhackers.com). Stolen data leaves as encrypted, typed records streamed over HTTPS, after which the malware deletes itself and leaves no persistence (gbhackers.com). Elastic documented four modules delivered through C2 tasking: ProManager (wallet overlays and clipboard address swapping), WinUpdate (a SOCKS5 proxy), SoftManager, and LockAppHost (an XMRig miner that disables Windows Update and Defender) (gbhackers.com). Elastic's YARA retrohunt matched about 4,700 samples on VirusTotal over the past year (elastic.co).
Remediation
Because the theft runs as a single burst, response often arrives too late, so defenders should block downloads from cheat and crack sites and treat unsigned Electron apps from GitHub as suspect (gbhackers.com). Teams should alert on new Defender exclusions in AppData and on Polygon RPC queries from user-writable paths, and Wazuh published a detection rule for the latter (rule 117317) (gbhackers.com). Anyone who ran a suspect build should rotate passwords, revoke sessions and move wallets from a clean device (gbhackers.com).