As reported by The Hacker News, Elastic Security Labs has documented four previously unreported programs — ProManager, WinUpdate, SoftManager, and LockAppHost — that share build tradecraft with the commercial Windows infostealer REVSTEALER but outlive the stealer's self-deletion. This is a meaningful evolution in how we should think about the economics of modern crimeware-as-a-service, and defenders should pay close attention.

Threat Alert: As reported by The Hacker News, Elastic Security Labs has documented four previously unreported programs — ProManager, WinUpdate, SoftManager, and LockAppHost — that share build tradecraft with the commercial Windows infostealer REVSTEALER but outlive the stealer's self-deletion.

Why This Matters Beyond the Headline

The industry has spent years treating infostealers as smash-and-grab operations: land, exfiltrate credentials and wallets, self-destruct, exit. REVSTEALER's linked module set breaks that mental model. The core stealer still does its job and deletes itself — but a parallel set of executables, sharing the same packer, runtime function resolution, and Polygon smart-contract C2 backup configuration, remains behind to monetize the host in slower, more durable ways.

That's a different risk calculus. The victim (and their endpoint detection) sees the high-noise stealer event end, assumes cleanup, and misses the four quiet tenants now running a clipboard hijacker, a wallet-overlay phishing layer, a reverse proxy for laundering attacker traffic, and an elevated cryptominer that has already neutered Windows Update and Microsoft Defender. The most dangerous of these, LockAppHost, abuses CMSTP.exe (MITRE ATT&CK T1218.003) for UAC bypass, then methodically disables five Windows Update services and adds Defender exclusions for common file types and folders before launching the miner under admin rights.

The Detection Gap This Exploits

The structural problem here is that incident response workflows often stop when the headline threat is removed. If your SOC closes the ticket after isolating the stealer binary and resetting compromised passwords, four separate executables in the user profile are still operating — using persistence mechanisms like Registry Run keys, scheduled tasks, logon scripts, and even a Windows service. Elastic's framing as an activity set rather than modular plugins is important: these are independent binaries, not loaded DLLs, so they survive any cleanup that only targets the parent process or its loaded modules.

Key insight: The shared use of Polygon smart contracts for backup configuration is a tell. It ties the activity set to the same operator infrastructure, but it also means takedown attempts against the stealer's primary C2 won't disrupt the modules' fallback channel. Expect this pattern to spread across other commercial stealers throughout 2026.

Who Is Most Exposed

The Detection Gap This Exploits
Crypto-adjacent users: ProManager's wallet-overlay attack and WinUpdate's clipboard address substitution directly target anyone handling wallet software or copying recovery phrases.
Unmanaged and BYOD endpoints: Persistence lives in the user profile, so non-admin infections still achieve long dwell time.
Organizations relying on native Defender without EDR: LockAppHost specifically disables Defender exclusions and Windows Update — the exact tools SMBs lean on as their entire security stack.
Remote workers: SoftManager's reverse-proxy capability turns the victim into an egress node for attacker traffic, creating legal and compliance exposure.

Shield53 Recommendations

Immediate Actions

  • Hunt for the four binary names in your environment: ProManager, WinUpdate, SoftManager, LockAppHost — and any unsigned executables in user-profile AppData paths that match their persistence patterns.
  • Inventory persistence surfaces: Query Registry Run keys, scheduled tasks, logon scripts, and services for entries pointing into user-writable directories. These should never legitimately live there.
  • Monitor CMSTP.exe execution from non-standard parents — a classic UAC bypass indicator that LockAppHost depends on.
  • Alert on Defender exclusion creation and Windows Update service state changes — these are high-signal events that should never originate from user-space processes.
  • Deploy tamper protection on Defender and block local service-disabling privileges for standard users via GPO.

Longer-Term Posture

  • Treat any confirmed infostealer infection as a multi-stage incident, not a credential-reset event. Assume dwell modules until forensically proven otherwise.
  • Block Polygon RPC endpoints used for smart-contract C2 backup at the egress proxy where feasible; investigate any user-space process making RPC calls to blockchain infrastructure.
  • Expand post-stealer runbooks to scan for clipboard-monitoring APIs, overlay windows, and reverse-proxy listeners — not just credential exfiltration artifacts.
  • Educate high-risk users (finance, crypto holders, developers) on the clipboard address-swap technique and recommend manual address verification on every transaction.

The takeaway for CISOs is sobering: the stealer economy is maturing from single-transaction theft into layered monetization. A host that "survived" an infostealer may simply be in the second act of a longer campaign. Assume compromise persists beyond the obvious.