REVSTEALER-linked module LockAppHost disables 18 Windows update and malware-removal mechanisms before mining

Remediation for a self-deleting stealer tends to end at the credential list, because credentials are all the stealer leaves to work with ^[4]. LockAppHost is the reason that is not enough. Once elevated it switches off 5 Windows Update services, 11 scheduled update tasks and 2 malware removal tasks ^[7], which is 18 update and scan mechanisms in one pass ^[1], and it writes Microsoft Defender exclusions for common folders and file types ^[7]. Elastic says those changes remain in place after the miner is found ^[8]. Killing a mining process is quick and visible. Restoring services and clearing exclusions is separate manual work.

How the four reach a host is the open part. The core stealer can download and run additional executables at the command line ^[11], which is the plausible route, but Elastic did not report seeing any of the four delivered onto a live REVSTEALER host ^[10]. Elastic describes the group as an "activity set" of separate executables rather than plug-ins loaded into the stealer ^[12]. For hunting, that framing is the useful one: each program installs into the user profile and stays ^[5], so key on those artefacts rather than on a REVSTEALER chain you may never see.

ProManager is the quieter half. Because it opens attacker-supplied content sized and positioned over the real wallet window and never touches the wallet program itself ^[17], a file integrity check on the wallet binary comes back clean ^[3]. The keystroke component that captures typed and pasted passphrases ^[18] sits in the profile with the rest.

Scale is unclear. Elastic's detection rule matched about 4,700 samples on VirusTotal over the past year, a count of files and not of confirmed infections ^[13].

One component has drawn more attention than it earns here. REVSTEALER gets at credentials protected by Chrome App-Bound Encryption by launching the browser in a debugger and reading the key from memory ^[14]. Elastic says the method was likely adapted from the public ElevationKatz project and that VoidStealer used it in March 2026 ^[15]; Gen Digital, which analysed VoidStealer, called that the first in-the-wild use ^[16]. It is commodity tradecraft now.

Impersonation carries some of the delivery. Morphisec documented a fake "Claude Opus 5 Free Desktop" application on August 31 that copied Anthropic branding, with no indication Anthropic itself was compromised ^[22]. From the February 2026 sample to the September 2 write-up is roughly six months of commercial sale ^[2]. What the stealer takes in that window includes Windows Credential Manager entries, VPN and FTP configuration and messaging session data ^[19], plus a decrypted Roblox session cookie that gives account access without the password ^[20]. Rotate the passwords without invalidating the sessions and the attacker stays signed in.