A credential-stealing malware called RevStealer is now spread through more than 100 linked domains, hijacked YouTube channels, and fake AI tools.
It targets gamers, content creators, and people who want free software. The goal is simple: steal saved passwords, cookies, game accounts, and crypto wallets, then disappear.
The campaign is built around things people search for, such as game cheats, account tools, and free versions of paid AI apps. Victims download what looks like a useful file, and a multi-stage infection starts in the background.
The operators appear to be financially motivated, and no nation-state link has been confirmed. The malware has been tracked by several security firms, including Elastic Security Labs and Morphisec.
Researchers from Akatsuki Legion also noted the malware in a new report published on November 9, 2026. They tied the distribution network to the same sites and hosting that others had seen.
One lure is a trojanized Electron app posing as Anthropic’s Claude Opus 5, which matches the earlier report on the fake Claude Opus 5 desktop app.
RevStealer Uses 100+ Domains and Hijacked YouTube Channels
Akatsuki Legion found four main hubs: elitecheatsx[.]live, elitemods[.]shop, satano[.]xyz, and cheatseller[.]com. These sites share the same image files, which points to a common owner.
By matching these file hashes and shared IP addresses, the team found about 100 more related domains. One hash links to around 70 domains, and another links to about 30. The researchers say not every domain is confirmed to spread RevStealer.
Some may be connected to other activity, and one cluster looks related to the REMCOS RAT. The lures cover a wide range of games and tools, including Minecraft, Roblox, Fortnite, Valorant, and Counter-Strike 2.
.webp)
Other bait includes Discord Nitro generators, Spotify and Canva premium tools, free VPNs, and fake ChatGPT, Grok, DeepSeek, and Gemini unlockers. Pirated copies of Slack, qBittorrent, and SteelSeries GG are also used.
The group also takes over existing YouTube channels. It posts AI-generated videos about game cheats and puts download links in the descriptions.
This is an old trick, and earlier reports on hijacking popular YouTube channels show how a trusted channel makes a risky link look safe.
After the download, the file runs through several stages. The first stage is packed with VMProtect, a tool that makes code hard to read. It uses Windows tools like WMI and PowerShell and injects code into other processes.
The next stage runs only in memory, so it leaves little on disk. A decoy file is also dropped to distract analysts.
Evasion & Data Theft
Before it does any harm, RevStealer checks whether it is being watched. It runs ten tests, covering memory size, CPU cores, hostname, username, graphics adapter, uptime, and sleep timing.
A virtual graphics adapter counts double. If the score reaches seven, the malware quits. It also quits if the system language is Russian, Ukrainian, or a Central Asian language, which suggests the operators want to avoid local police attention.
If the machine passes, the malware decrypts its AES-256-CBC payload and saves it in a randomly named folder under AppData.
It tries to add that folder to Microsoft Defender’s exclusion list. It then uses 14 indirect syscall wrappers and FNV-1a API hashing to avoid security hooks.
The theft is broad. It takes passwords, cookies, and history from Chrome, Edge, Brave, Firefox, Opera, and Vivaldi. It can bypass Chrome’s App-Bound Encryption using hardware breakpoints.
It also goes after 225 Chromium password-manager extensions, 51 standalone wallet and password apps, and VPN and 2FA tools. Steam, Roblox, Battle.net, EA Desktop, and Minecraft files are also taken, along with screenshots and clipboard data.
The data is sent over HTTPS port 443 as encrypted records. If the main server is down, the malware reads a backup address from a Polygon smart contract, a method known as EtherHiding.
Similar cases appear in reports on how attackers hide malware on Polygon. Because blockchain data cannot be removed, this backup is hard to shut down.
RevStealer does not stay on the system, and it deletes itself after the theft. The report also says the operator can push ransomware through the same channel, and a LockAppHost module can run the XMRig coin miner.
Defenders should watch for Defender exclusion changes, new executables in AppData, and non-browser programs contacting Polygon RPC servers. Users should avoid cheats and cracked software, as shown in cases where gaming channels and SEO tricks lead to malware.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | elitecheatsx[.]live | Main distribution hub |
| Domain | elitemods[.]shop | Main distribution hub |
| Domain | satano[.]xyz | Main distribution hub |
| Domain | cheatseller[.]com | Main distribution hub |
| Domain | yimmodmenu[.]org, luxurycheats[.]live, betterdiscordapp[.]live, luxurycheat[.]live, yimmenu-gta5[.]com, dlss5swapper[.]pro, scoobymenu[.]live | Related domains sharing IPs with main hubs |
| Domain | polygon-rpc[.]com, rpc-mainnet[.]matic[.]network, rpc[.]ankr[.]com, polygon-mainnet[.]infura[.]io, matic-mainnet[.]chainstacklabs[.]com, polygon-mainnet[.]g[.]alchemy[.]com | Polygon RPC endpoints used for fallback C2 |
| SHA256 | 251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d | Initial ZIP archive |
| SHA256 | d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e | Stage 1 packer/stager |
| SHA256 | 724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc | Stage 2 in-memory payload |
| SHA256 | 851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4 | Decoy payload |
| MD5 | 23189bc66fc17afca7d0f8f81def27dc | YimMenuV2_Enhanced.rar |
| MD5 | 23337b495bcb5c3635d9c89adb4e40ee | CheraxMenu.rar |
| MD5 | 3c609886f8b49ebfd7c7c279abc74cb4 | YimMenuV1_Legacy.rar |
| MD5 | c083a98b7041991528225a4b85bfae67 | EliteCheatsX-2.0.zip |
| Resource hash | 44d72fd03a76d5a1357c1cbe0eb4b94d079e0e6820cc8c6ebcc82737767f7577 | Linked to about 70 domains |
| Resource hash | f6be9f1e47c2e2bb1a47c7f917bae7b6d73f0d4edd26c6a8d81f1375ce55475e | Linked to about 30 domains |
Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
The post RevStealer Uses 100+ Domains and Hijacked YouTube Channels to Spread Credential-Stealing Malware appeared first on Cyber Security News.