According to reports from Morphisec, a fake Claude Opus 5 Free Desktop application has been distributing RevStealer malware designed to steal data from more than 50 cryptocurrency wallets, password managers, and web browsers on Windows computers. The malware is delivered through a trojanized Electron application that uses Anthropic's branding and offers free access to its paid artificial intelligence model. The primary lure is distributed as a roughly 101 MB archive containing a 64-bit Electron application that presents no meaningful user interface and launches no visible application window. Instead of delivering a working AI client, the Electron wrapper serves as a loader for an AES-256-CBC-encrypted native malware payload concealed in its resources. Before appearing under the Claude name, the malware was distributed through GitHub repositories and websites advertising video game cheats, as reported by Morphisec Threat Labs. The researchers identified this as a prominent recent delivery method that uses social-engineering to lure users with free access claims. Latest reports confirm this represents active malware distribution that steals passwords, browser data, screenshots, and targets more than 50 cryptocurrency wallets, creating concrete security threats with immediate relevance for crypto users.
As reported by Morphisec, RevStealer first examines the computer for signs that security researchers are watching it before releasing its main payload. The loader requires at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter. Hostname and username checks compare the device against a blocklist associated with research systems, while a separate JavaScript timing check measures execution around a debugger statement and destroys its encoded string table if execution pauses for more than about 100 milliseconds. This frustrates manual reverse engineering and debugger-driven analysis. The native stage conducts 10 additional checks that produce a weighted anti-virtual-machine score and examines the computer's language settings, shutting down on systems configured for Russian, Ukrainian, and several Central Asian languages. The malware is designed to leave few traces on the infected machine, which can complicate detection and forensic analysis. When RevStealer detects anything out of the ordinary, it does not proceed to the next stages of infection, making it highly effective at avoiding detection by security researchers.
According to Morphisec, on accepted devices, RevStealer searches browser databases, encryption keys, and extension storage for information providing access to online accounts. The malware targets Windows Credential Manager, 12 password managers, more than 50 cryptocurrency wallets, and browser session cookies. Additional targets include VPN configurations, remote-access credentials, clipboard contents, messaging application data, selected documents, screenshots, game launchers, and OBS streaming profiles. The malware inspects local browser databases and password-manager records, collects cookies and VPN or remote-access configuration files, captures messaging data and takes screenshots. It is also programmed to copy specific documents and files that may contain private keys or wallet backups, increasing the risk to users who keep private keys, seed phrases or wallet backups on the same device used for web browsing or messaging. RevStealer specifically targets cryptocurrency wallet data from over 50 wallets, browser databases, cookies, password-manager records, VPN and remote-access settings, messaging data, screenshots and selected documents.
As reported by Morphisec, unlike malware that creates scheduled tasks or startup entries to remain on a computer, RevStealer does not establish persistence. The program collects available information, sends it to operators, and removes itself. The malware can also recover an alternative server address from a smart contract on the Polygon blockchain when its main command-and-control server becomes unavailable, allowing operators to change infrastructure without rebuilding the malware. When checks pass, the payload is decrypted, saved under a randomized filename and executed with minimal visible activity. The malware registers a vectored exception handler to keep the theft routine running if individual collectors fail and decrypts C2 configuration only when needed, streams collected data in encrypted typed records, and deletes itself after completing its task. Stolen browser cookies can expose accounts even when users employ multi-factor authentication, as criminals may reuse valid session cookies instead of requiring passwords and second authentication factors. The malware's operational design ensures it harvests sensitive data quickly and efficiently before disappearing from the system. According to Morphisec, the native payload resolves Windows APIs without an import table and calls the kernel through 14 indirect syscall wrappers, bypassing the exported functions where user-mode monitoring hooks sit.
According to Morphisec, the Claude impersonation follows several campaigns where attackers packaged credential-stealing tools as familiar applications. In August, fake downloads of The Odyssey were delivering Lumma Stealer through Windows executable files disguised as movie releases. A separate July campaign used lookalike meeting pages and compromised Telegram accounts to target crypto workers, with North Korea-linked BlueNoroff operators scanning browsers for Ethereum and Solana wallets. Kaspersky identified another modular malware framework called OkoBot that used fake recovery screens and keylogging against cryptocurrency investors across Brazil, Vietnam, Canada, Mexico, and Turkey. The reports describe a pattern of threat actors using counterfeit software and specialized malware to directly access wallet files and browser-stored credentials. Microsoft previously warned users of 'Crypto Clipper' malware spread via USB drives, highlighting the diverse methods attackers use to target cryptocurrency holders. The campaign underscores how AI branding has become a high-value social-engineering surface, with attackers increasingly exploiting the desire for free or unrestricted access to premium AI models, particularly where users may be willing to bypass official vendor channels, download GitHub projects, or turn off security controls to run unofficial tools.
