REVSTEALER Leaves Four Hidden Programs Behind, One Kills Windows Defender to Mine Crypto

Key points

• Elastic Security Labs has identified four previously unreported helper programs tied to REVSTEALER, a Windows information stealer that grabs saved passwords and browser data.
• The four programs, named ProManager, WinUpdate, SoftManager and a fourth unnamed module, remain on the machine after the main stealer wipes itself.
• One helper switches off Windows Update and Microsoft Defender, then launches a cryptocurrency miner that quietly uses the victim's computer to earn digital coins for the attackers.
• The finding shows REVSTEALER isn't a one-shot theft tool but a foothold for longer-term abuse of the infected PC.

A Windows password-stealing program called REVSTEALER is doing more than researchers first thought. It steals what it came for, deletes itself to cover its tracks, and quietly leaves four small helper programs behind to keep working on the machine.

That's the finding from Elastic Security Labs, whose researchers named the four leftover programs ProManager, WinUpdate, SoftManager and a fourth unnamed module. We first covered REVSTEALER on 6 September 2026, when a related campaign was already disabling Windows defences on the way in.

One of those helpers is particularly nasty. Before doing anything else, it turns off Windows Update, the service that delivers security patches, and Microsoft Defender, Windows' built-in antivirus. Then it starts a cryptocurrency miner: software that uses the computer's processor to generate digital coins for whoever planted it.

What is REVSTEALER actually doing?

REVSTEALER is an information stealer, meaning a program built to scoop up saved passwords, browser cookies and cryptocurrency wallet files, then send them to the attacker. Once done, the main stealer deletes itself from disk so investigators have less to find.

The twist Elastic documented is that the stealer's only the opening act. Its four helper programs stay behind, giving attackers a way to keep earning from the same infection for weeks or months.

Which programs are left behind, and what do they do?

They pose as ordinary-sounding Windows utilities, so a casual glance at Task Manager wouldn't flag them.

The naming is the giveaway to a trained eye. Real Windows Update runs as a service called wuauserv, not as a standalone program sitting in a user folder.

Should ordinary Windows users be worried?

Yes, though the defence is boring and effective: keep Windows Update on, keep Defender on, and don't run programs from sources you don't trust. REVSTEALER mostly arrives through cracked software and fake installers.

If your PC has suddenly become sluggish or the fan spins constantly when you're doing nothing, that's a classic sign of a hidden miner. Check Task Manager for processes named ProManager or SoftManager running from odd locations such as your AppData folder.

Anyone who thinks they were infected should assume their saved browser passwords are already in criminal hands. Change the important ones, email, banking and work accounts, from a clean device. Turn on multi-factor authentication, the second login step that sends a code to your phone or app, wherever it's offered. It won't undo the theft, but it makes stolen passwords far less useful on their own.

Why this matters beyond one stealer

Info-stealers used to be smash-and-grab. What Elastic is describing is closer to a tenant moving in: steal the valuables on day one, then quietly rent out the machine's processor for as long as no one notices. Disabling the operating system's own updates and antivirus is what makes that tenancy possible.

For IT teams, the practical signal is simple: alert on any process that stops the Windows Update or Defender services, regardless of where it came from. That single detection rule would've caught this campaign before the miner earned a single coin.