REVSTEALER Leaves Four Hidden Programs Behind, One Kills Windows Defender to Mine Crypto

Key points

• Elastic Security Labs has identified four previously unreported helper programs tied to REVSTEALER, a Windows information stealer that grabs saved passwords and browser data.
• The four programs, named ProManager, WinUpdate, SoftManager and a fourth module, remain on the machine after the main stealer wipes itself.
• One helper switches off Windows Update and Microsoft Defender, then launches a cryptocurrency miner that quietly uses the victim's computer to earn digital coins for the attackers.
• The finding shows REVSTEALER is not a one-shot theft tool but a foothold for longer-term abuse of the infected PC.

A Windows password-stealing program called REVSTEALER is doing more than researchers first thought. It steals what it came for, deletes itself to cover its tracks, and quietly leaves four small helper programs behind to keep working on the machine.

That is the finding from Elastic Security Labs, whose researchers named the four leftover programs ProManager, WinUpdate, SoftManager and a fourth module.

One of them is particularly nasty. Before doing anything else, it turns off Windows Update, the service that patches security holes, and Microsoft Defender, the antivirus built into Windows. Then it starts a cryptocurrency miner: software that uses the computer's processor to generate digital coins for whoever planted it.

What is REVSTEALER actually doing?

REVSTEALER is an information stealer, meaning a program built to scoop up saved passwords, browser cookies, cryptocurrency wallet files and similar data, then send them to the attacker. Once that job is done, the main stealer deletes itself from the disk so investigators have less to find.

The twist Elastic documented, and which was also picked up by The Hacker News, is that the stealer is only the opening act. The four helper programs stay behind and give the attackers a way to keep earning from the same infection for weeks or months.

Which programs are left behind, and what do they do?

The helpers pose as ordinary-sounding Windows utilities so a casual glance at Task Manager would not flag them. Here is how Elastic broke them down.

The naming is the giveaway to a trained eye. Real Windows Update runs as a service called wuauserv, not as a standalone program sitting in a user folder.

Should ordinary Windows users be worried?

Yes, but the defence is boring and effective: keep Windows Update turned on, keep Defender turned on, and do not run programs from sources you do not trust. REVSTEALER, like most stealers, mostly arrives through cracked software, fake installers and dodgy download sites.

If your PC has suddenly become slow, runs hot, or the fan spins constantly when you are doing nothing, that is a classic sign of a hidden miner. Check Task Manager for processes named ProManager, WinUpdate or SoftManager running from odd locations such as your AppData folder.

Anyone who thinks they were infected should assume their saved browser passwords are already in criminal hands. Change the important ones (email, banking, work accounts) from a clean device, and turn on multi-factor authentication, the second login step that sends a code to your phone or app, wherever it is offered. Multi-factor would not have stopped the initial infection, but it stops the stolen passwords from being useful on their own.

Why this matters beyond one stealer

Info-stealers used to be smash-and-grab. What Elastic is describing is closer to a tenant moving in: steal the valuables on day one, then quietly rent out the machine's processor to mine coins for as long as no one notices. Turning off the operating system's own updates and antivirus is what makes that possible.

For company IT teams, the practical takeaway is to alert on any process that stops the Windows Update or Defender services, wherever it comes from. That single behaviour would have caught this campaign long before the miner started earning.