Elastic documents REVSTEALER-linked modules that disable Windows defenses
Image: Primary Elastic Security Labs documented four previously unreported programs associated with the REVSTEALER Windows information stealer. One module, LockAppHost, can add Microsoft Defender exclusions, disable Windows Update services and tasks, and hide a cryptocurrency miner in legitimate Windows processes.
Elastic said the modules persist after the core stealer deletes itself. The connection is based on shared code and investigative context: Elastic did not observe the modules being delivered to a live REVSTEALER host. The stealer has been distributed through game-cheat lures and impersonated or pirated software, including a fake Claude application.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
