Crime01 September, 20263 min read
Fake Claude Opus 5 Desktop App Spreads RevStealer Malware Stealing Crypto, Passwords, Browser Data
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
RevStealer is distributed via a fake Claude Opus 5 desktop app and trojanized Electron projects. It steals crypto wallets, browser data, passwords, cookies, messages, and selected documents.
RevStealer via Fake Claude
A fake Claude desktop application is being used to distribute RevStealer, a Windows malware strain built to steal crypto, password and browser data, according to a Monday report by Morphisec. The most notable lure is a fake “Claude Opus 5 Free Desktop” project that impersonates AI developer Anthropic and promises free access to Claude. Morphisec said RevStealer is designed to leave few traces by searching browser databases, cookies, password-manager records, VPN and remote-access settings, messaging data, screenshots and selected documents.
The malware also targets over 50 cryptocurrency wallets and checks whether the machine looks like a real user device before unlocking its malicious payload, including available memory, the number of processor cores, hostname, username and graphics hardware. If the system passes those checks, the payload is decrypted, stored under a random name and covertly executed, while the report notes that if RevStealer detects anything out of the ordinary, it does not move on to the next stages of infection and malicious activity.
Evasion and data theft
SC Media said RevStealer is spread through a GitHub repository offering a fake free version of Anthropic’s Claude Opus 5 model, with the main version analyzed coming from the GitHub repository claude5opus/Claude-Opus-5-Free-Desktop. It said the loader performs anti-sandbox analysis including checks for at least 2 GiB of physical memory, at least two logical CPU cores, and at least one recognized graphics adapters based on a hardcoded list of vendors. SC Media reported that RevStealer aims to remain mostly invisible to endpoint security systems by using evasion measures including sandbox checks, string encryption, stealthy API resolution, indirect system calls and incremental data exfiltration.
After establishing contact with its C2 server, the malware sends a 17-field system fingerprint along with a snapshot of installed software, running processes, environment variables, clipboard contents and a desktop screenshot. If the main C2 server becomes unavailable, SC Media said the malware sends Polygon JSON-RPC eth_call requests to a smart contract on the Polygon blockchain containing a fallback address, allowing the operators to rotate infrastructure without rebuilding the malware.
Account hijacks and response
PYMNTS reported that cybercriminals are targeting users of Anthropic’s Claude AI platform with malware that can steal authenticated login sessions, potentially allowing attackers to access accounts without passwords or two-factor authentication. It said Anthropic identified cases in which attackers appeared to consume paid Claude usage after account owners had stopped using the service, and that stolen session cookies can allow attackers to impersonate an already-authenticated user. PYMNTS also described a separate campaign tracked by Huntress in which attackers used sponsored Bing advertisements between July 21 and July 22 to direct users searching for the Claude desktop application to a malicious Claude Artifact hosted on the legitimate claude.ai domain.
Huntress identified at least 29 compromised organizations and roughly 7,100 downloads before Anthropic removed the malicious page, and PYMNTS said the fake installer deployed SectopRAT, a remote-access Trojan capable of harvesting browser credentials, cookies, files and payment-card information. In response, PYMNTS said Anthropic has signed affected accounts out, removed stored payment methods and refunded confirmed fraudulent charges, while warning that those measures do not remove malware from infected devices.