RevStealer Leverages Blockchain to Evade Detection

RevStealer is a Windows infostealer designed to evade detection. The malware disguises itself as an Electron desktop application and impersonates legitimate software, such as a free version of the AI model 'Claude Opus 5 Desktop'. It collects sensitive information like browser databases, session cookies, cryptocurrency wallets, password-manager artifacts, and VPN configurations.

The attackers distributed RevStealer through fake GitHub repositories and game-cheat-themed sites. The malware has multiple evasion techniques to avoid detection, including runtime string decryption, concealed API resolution, indirect syscalls, VM scoring, and a CAPTCHA gate that stops automated execution.

What makes RevStealer unique is its use of the Polygon blockchain as a fallback address for the command-and-control server. If the primary C2 server is unreachable, the malware queries a smart contract on the Polygon blockchain to obtain a replacement address, making it difficult for defenders to disrupt the campaign through seizure.

Morphisec takes a prevention-first approach using Automated Moving Target Defense (AMTD) to prevent RevStealer from executing. AMTD morphs the runtime memory environment so that the malware's assumptions are invalid at the moment of execution, making detection and response too late for the attackers.