This one deletes itself when it's finished. That's not the good news.

Seventeen YouTube channels, most of them taken from the people who built them, were quietly posting short AI-made videos about game cheats. The videos pointed at two download sites. What came down was REVSTEALER, and Elastic Security Labs published its analysis of the whole operation on 2 September.

The stealer itself behaves like a burglar with a schedule. It takes browser passwords and cookies, crypto wallets, gaming accounts, messaging data and files, reports "complete" to its server, then removes itself and leaves nothing to persist. That is meant to look like the end of the story. It isn't. Elastic found four companion programs, never documented before, that stay on the machine afterwards. ProManager draws fake windows over real crypto wallet apps to capture what you type into them. WinUpdate, despite the name, watches your clipboard and swaps any cryptocurrency address you copy for one of its own. SoftManager turns your PC into a relay so somebody else's traffic leaves the house through your connection. And LockAppHost adds Defender exclusions, disables five Windows Update services, eleven scheduled update tasks and two malware removal tasks, then runs a miner hidden inside legitimate Windows processes.

Game cheats are the main lure, but not the only one. The same family has arrived dressed as pirated and impersonated software, including a counterfeit "Claude Opus 5 Free Desktop" app. The symptom to know is that last module: a PC that runs hot and slow for no obvious reason, and updates that simply stopped arriving. Windows going quiet for weeks is not normal, and it is not usually Microsoft's fault.

Tendvane's Windows Update repair wizard resets exactly those services and scheduled tasks, so if something switched them off you get a plain answer rather than a machine that has silently stopped patching itself.