# New Malware Ecosystem Leaves Behind Four Persistence Modules After Self-Deleting Infostealer Runs Its Course
A recently documented malware operation has drawn attention from security researchers for its sophisticated multi-stage infection strategy. Rather than simply stealing data and disappearing, the malware installs four separate persistence modules that continue operating on an affected machine long after the original stealer removes itself from the system.
## The Core Threat: A Commercial Information Stealer
The central piece of this operation is a Windows-based information stealer that has been operating as a commercial product since early 2026. The stealer targets a wide range of sensitive data, including browser passwords and session cookies, cryptocurrency wallet files, gaming account credentials, and messaging data. It also harvests documents, virtual private network configurations, and credentials stored in Windows Credential Manager and third-party password managers.
What makes this particular stealer noteworthy is its complete self-removal strategy. After exfiltrating its collected data to a command-and-control server, it wipes itself from the infected system, leaving behind no obvious signs of persistence at the core level. This approach is designed to make forensic analysis difficult and to give the impression that an infection has been fully resolved.
However, researchers have discovered that the stealer is capable of dropping additional executable files onto the system before it deletes itself. These files operate independently and remain hidden within user profiles, continuing their malicious activities undisturbed.
## Four Post-Infection Modules Identified
Security analysts have identified and named four distinct programs that persist after the core stealer is gone. These modules share the build characteristics of the original stealer, including the same software packer, runtime function resolution methods, and a reliance on Polygon blockchain smart contracts for backup configuration storage. Each module installs itself into the user’s profile directory and maintains its own persistence mechanism.
### ProManager: The Crypto Wallet Overlay Attacker
This module specifically targets users of desktop cryptocurrency wallets. Because many of these wallets are built using the Electron framework, ProManager can determine the exact window position of the wallet application. It then opens attacker-controlled content sized and positioned to appear as a legitimate overlay on top of the real wallet interface — all without modifying or touching the wallet software itself.
A separate component of ProManager records any text typed or pasted into fields it identifies as password or passphrase inputs, capturing sensitive credentials even if they are copied from the clipboard. The module maintains persistence through a Registry Run key, ensuring it executes every time the user logs in.
### WinUpdate: The Clipboard Hijacker
This module runs continuously in the background, monitoring the system clipboard for cryptocurrency wallet addresses. When it detects a copied address, it replaces it with an attacker-controlled address, silently redirecting any future cryptocurrency transactions to the criminal’s wallet. It also scans clipboard content for text resembling wallet recovery phrases, which can grant full access to a user’s cryptocurrency holdings.
WinUpdate establishes persistence through a scheduled task, with a Registry Run key serving as a secondary fallback mechanism if the primary method fails.
### SoftManager: The Stealth Proxy
SoftManager transforms the infected machine into a reverse proxy server, routing the attacker’s network traffic through the victim’s internet connection. This technique provides the attacker with anonymity while potentially allowing them to bypass IP-based restrictions or engage in further criminal activity using the victim’s identity and network reputation.
It uses multiple persistence methods — a logon script, scheduled task, or Registry Run key — making it particularly difficult to remove completely.
### LockAppHost: The System Saboteur and Miner
This is the most destructive of the four modules. Once active, it escalates privileges to administrator level by abusing the Windows CMSTP service control tool, falling back to a standard user elevation prompt if that method fails.
After gaining elevated access, LockAppHost systematically weakens the machine’s security posture. It adds Microsoft Defender exclusions for common folders and file types, disables five Windows Update services, turns off eleven scheduled update tasks and two malware removal tasks, and hides a cryptocurrency mining process within legitimate Windows system processes.
Critically, the defensive changes it makes persist even if the mining activity is eventually discovered and stopped. This means that even if a user removes the miner, the system remains significantly more vulnerable to future infections. LockAppHost establishes persistence through either a Registry Run key or by installing itself as a Windows service.
## Infection Vectors and Delivery Methods
The stealer primarily reaches victims through game-cheat websites promoted via social media. Researchers identified at least seventeen YouTube channels — many of which had been hijacked from their original owners — that distributed links to two cheat websites using AI-generated promotional videos.
The malware has also been distributed as pirated or impersonated software. In one documented instance, a fake desktop application mimicking a well-known AI tool was packaged with the malware, copying the branding of the legitimate company but with no indication that the company itself was compromised.
The core stealer includes extensive anti-analysis protections. It evaluates the machine against ten sandbox detection checks and halts execution if the score is too high. It also terminates automatically if the system language matches one of ten languages associated with Russia and Central Asia. Additionally, it resolves Windows functions without using standard import tables and calls the kernel through indirect system calls to bypass security product hooks.
## Technical Sophistication and Evasion
The malware ecosystem demonstrates a high level of technical sophistication. The stealer uses direct browser debugging techniques to extract credentials protected by Chrome’s App-Bound Encryption, reading the decryption key from memory while the browser runs in a debugged state. This technique, while not new, remains effective against modern browser security architectures.
For command-and-control resilience, the malware uses the Polygon blockchain through a technique known as EtherHiding, which allows it to retrieve backup configuration addresses directly from smart contracts. This makes takedown efforts significantly more difficult, as the infrastructure is distributed across a decentralized network rather than residing on a single server.
Unpacked versions of the malware include a verification prompt requiring a random six-character code before execution, a gate designed to thwart automated analysis tools used by security researchers.
## Detection and Response Guidance
Security teams have been provided with YARA rules and behavior-based detection signatures to identify infections. However, the public detection rules cover only three of the four modules, with no rule currently available for the mining module LockAppHost.
For organizations and individuals responding to a suspected infection, several key steps are recommended. Because the core stealer deletes itself, the presence of the persistence modules may be the only remaining evidence of compromise. On systems where LockAppHost has run, responders should re-enable disabled Windows Update services and scheduled tasks, remove all Microsoft Defender exclusions added by the malware, and inspect suspended instances of legitimate system processes such as nslookup.exe or svchost.exe for hidden mining activity.
Since the stealer captures session cookies and sensitive encryption keys, password resets alone are insufficient. Affected users must also change passwords and terminate all active sessions on compromised accounts to fully remediate the intrusion.
—
## Frequently Asked Questions
**What is REVSTEALER?**
REVSTEALER is a commercial Windows-based information stealer that has been actively sold and distributed since early 2026. It targets browser credentials, cryptocurrency wallets, gaming accounts, messaging data, and other sensitive files before deleting itself from the infected system.
**How does the malware persist if the stealer deletes itself?**
The stealer drops separate executable programs onto the system before it removes itself. These programs — ProManager, WinUpdate, SoftManager, and LockAppHost — each install independently into the user’s profile and establish their own persistence mechanisms, allowing them to continue running long after the original stealer is gone.
**Why is LockAppHost considered the most dangerous module?**
LockAppHost is considered the most dangerous because it not only runs a cryptocurrency miner but also systematically disables critical Windows security features, including Windows Update services, Microsoft Defender protections, and scheduled security tasks. Even if the miner is removed, the weakened security settings remain in place, leaving the system exposed to additional threats.
**How does ProManager steal cryptocurrency wallet credentials without modifying the wallet software?**
ProManager uses the Electron framework’s window position data to open a malicious overlay that matches the size and location of the legitimate wallet window. When users type or paste passwords and passphrases into what they believe is their wallet interface, the data is captured by the overlay module and sent to the attacker.
**Can a simple password reset fix an infection?**
No. Because the stealer captures session cookies and Chrome’s App-Bound Encryption keys, a password reset does not terminate active sessions or protect against session hijacking. Users must also manually end all active sessions across their accounts to fully secure them.
**How can I protect myself from this type of malware?**
Avoid downloading unofficial or “free” versions of paid software and game cheats. Only install applications from official sources and verified publishers. Keep Windows Update enabled and ensure Microsoft Defender is actively running. Be cautious of YouTube links promoting game cheats, especially those from channels with recently changed content or branding.
**Why does the malware target Russian and Central Asian language systems?**
This is a common anti-analysis technique. By terminating on systems configured with specific languages, the malware avoids execution in regions where security research and law enforcement activity is more prevalent, reducing the likelihood of being analyzed or intercepted.
**What is EtherHiding?**
EtherHiding is a technique where malware stores backup configuration data on a blockchain smart contract, typically on the Polygon network. This allows the malware to retrieve command-and-control server addresses even if the original servers are taken down, making the infrastructure significantly harder to dismantle.
—
## Conclusion
The emergence of this multi-module malware ecosystem highlights a troubling trend in cybersecurity: the shift toward modular, persistent threat architectures that survive even when the initial attack vector is removed. The fact that the core stealer deletes itself while leaving behind four independently functioning modules means that traditional remediation approaches — such as simply removing the primary malicious file — are no longer sufficient.
Organizations and individual users alike must adopt a more holistic approach to incident response, one that assumes secondary payloads may remain hidden long after the primary threat appears neutralized. The sophistication of the anti-analysis techniques, the use of blockchain infrastructure for resilience, and the strategic targeting of Windows security features all point to a well-resourced operation with commercial intentions.
Staying informed about these evolving threats, maintaining robust security hygiene, and adopting layered defense strategies remain the most effective ways to reduce the risk of infection and minimize the impact of a breach.
Thank you for reading
