Elastic documents REVSTEALER-linked modules that disable Windows defenses

Elastic Security Labs documented four previously unreported programs associated with the REVSTEALER Windows information stealer. One module, LockAppHost, can add Microsoft Defender exclusions, disable Windows Update services and tasks, and hide a cryptocurrency miner in legitimate Windows processes. Elastic said the modules persist after the core stealer deletes itself. The connection is based on shared code and investigative context: Elastic did not observe the modules being delivered to a live REVSTEALER host. The stealer has been distributed through game-cheat lures and impersonated or pirated software, including a fake Claude application.