RevStealer Malware Spreads Via 100+ Domains and Hijacked YouTube Channels
RevStealer malware is being distributed through over 100 domains and compromised YouTube channels, targeting gamers and content creators with fake AI tools and game cheats to steal credentials and cryptocurrency.
A sophisticated credential-stealing malware campaign, dubbed RevStealer, is actively distributing its payload through a network of over 100 domains and hijacked YouTube channels. The malware primarily targets gamers, content creators, and individuals seeking free software by luring them with fake AI tools, game cheats, and cracked applications. The ultimate goal of the operators is to steal sensitive information such as saved passwords, browser cookies, gaming accounts, and cryptocurrency wallet details.
The campaign leverages popular search terms related to gaming and software, presenting victims with seemingly legitimate download links. Upon execution, the downloaded file initiates a multi-stage infection process. Security researchers from Elastic Security Labs, Morphisec, and Akatsuki Legion have been tracking the malware's infrastructure. Akatsuki Legion identified four primary distribution hubs—elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com—which share common image files, indicating a single operator.
By analyzing file hashes and shared IP addresses, researchers uncovered approximately 100 additional related domains. While not all domains are confirmed to be actively distributing RevStealer, some appear linked to other malware families, such as the REMCOS RAT. The lures are diverse, encompassing popular games like Minecraft, Roblox, Fortnite, Valorant, and Counter-Strike 2, as well as tools such as Discord Nitro generators, Spotify and Canva premium access, VPNs, and fake AI applications like Claude Opus 5, ChatGPT, Grok, DeepSeek, and Gemini.
Compromised YouTube channels are also being utilized to spread the malware. Threat actors post AI-generated videos promoting game cheats and include malicious download links in the video descriptions. This tactic exploits the trust associated with established channels to make risky downloads appear more legitimate. The initial stage of the malware is packed with VMProtect to obfuscate its code, employing Windows tools like WMI and PowerShell for execution and process injection. Subsequent stages are designed to run entirely in memory, minimizing on-disk artifacts, and a decoy file is dropped to mislead analysis.
RevStealer incorporates robust evasion techniques before executing its malicious payload. It performs ten distinct checks, evaluating factors such as memory size, CPU cores, hostname, username, graphics adapter, and system uptime. If the system is identified as a virtual environment or if the evasion score reaches seven, the malware terminates itself. Additionally, it avoids execution on systems with Russian, Ukrainian, or Central Asian language settings, suggesting the operators aim to evade local law enforcement.
Upon successful evasion, the malware decrypts its AES-256-CBC payload and stores it in a randomly named folder within the AppData directory. It attempts to add this folder to Microsoft Defender's exclusion list. To further evade detection, it utilizes indirect syscall wrappers and FNV-1a API hashing to bypass security hooks. The data exfiltration capabilities are extensive, targeting credentials and cookies from major browsers like Chrome, Edge, Brave, Firefox, Opera, and Vivaldi. It can also bypass Chrome's App-Bound Encryption and targets over 225 Chromium password manager extensions, 51 standalone wallet and password applications, and VPN/2FA tools.
Beyond browser data, RevStealer targets gaming platforms such as Steam, Roblox, Battle.net, EA Desktop, and Minecraft. It also captures screenshots and clipboard data. All stolen information is exfiltrated over HTTPS on port 443 in encrypted records. In a novel fallback mechanism, if the primary command-and-control server is unavailable, the malware can retrieve backup server addresses from a Polygon smart contract, a technique known as EtherHiding, making the C2 infrastructure resilient.
RevStealer is designed to be stealthy and self-deleting after completing its data theft operations. The campaign also has the capability to deploy ransomware and run the XMRig coin miner. Security recommendations include monitoring for Microsoft Defender exclusion changes, new executables in AppData, and unusual network activity involving Polygon RPC endpoints. Users are strongly advised to avoid downloading game cheats, cracked software, and unofficial AI tools, especially from suspicious websites or links found in social media descriptions.