Fake Claude App Targets 50+ Crypto Wallets with Revstealer

A malicious cyber operation leveraging the popularity of artificial intelligence has uncovered a new vector for crypto asset theft, with a fake "Claude Opus 5 Free Desktop" application distributing RevStealer malware to Windows users. Cybersecurity firm Morphisec revealed that this rogue software is actively harvesting sensitive data from over 50 cryptocurrency wallets, web browsers, and password managers, exploiting user trust in Anthropic’s branding to deliver a sophisticated trojan. The Trojanized AI Front: How the Infection Spreads The threat vector relies on social engineering rather than traditional hacking exploits. Morphisec Threat Labs identified that the malware is packaged as a 101-megabyte archive containing a 64-bit Electron application. While victims expect a functional interface for Anthropic’s paid AI model, the program fails to open any visible window. Instead, it operates silently in the background, preparing an encrypted native payload for execution. Before adopting the Claude persona, the malware was distributed through GitHub repositories and websites advertising video game cheats. The shift to AI branding represents a calculated pivot toward a demographic more likely to install unverified software to access premium AI capabilities for free. The payload is stored as an AES-256-CBC-encrypted resource within the application. Once initial checks pass, the loader decrypts the file, writes it under a random name in the Windows AppData directory, and launches the malware without user notification. A critical component of this attack is the attempt to add the user’s AppData folder to the Microsoft Defender exclusion list. This action is designed to limit forensic evidence on the device while enabling the malware to collect and transmit information with reduced interference from standard security software. Advanced Evasion Techniques and Anti-analysis Measures RevStealer employs multi-layered evasion tactics to survive detection by security researchers and automated analysis tools. The loader performs rigorous environment checks before releasing its main payload. It requires the host system to possess at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter. Furthermore, the malware compares hostname and username data against a blocklist associated with research systems. To defeat static analysis and debugging tools, the loader implements a timing test that measures the delay around a JavaScript debugger instruction. If execution pauses for more than approximately 100 milliseconds, the malware wipes its own encoded string table, effectively rendering it inert for analysis. The native stage of the infection introduces an additional 10 checks that generate a weighted anti-virtual-machine score. The malware also inspects the computer’s language settings and shuts down entirely on systems configured for Russian, Ukrainian, and several Central Asian languages, likely to avoid attribution or regional scrutiny. For automated sandboxes, the infection chain includes a CAPTCHA window that requires human interaction before the process can continue. If a device fails any of these early checks, the loader does not decrypt or expose the payload, leaving analysts with minimal malicious activity to examine. Scope of Data Exfiltration and Victim Impact The primary objective of RevStealer is the mass exfiltration of high-value digital credentials. The malware specifically targets components that hold cryptographic keys and session tokens. Targeted Component Data Harvested Risk Level Cryptocurrency Wallets Private keys, seed phrases, transaction history Critical Web Browsers Saved passwords, cookies, autofill data High Password Managers Master passwords, vault entries Critical System Files OS version, hardware IDs, user profile info Moderate Morphisec noted that the sheer volume of targeted wallet types - exceeding 50 distinct applications - indicates a broad, indiscriminate approach to crypto theft. Victims are often unaware of the breach until funds have been drained from their digital assets. The lack of a visible interface during installation makes detection nearly impossible for non-technical users who may assume the software has simply failed to load. Immediate Security Implications for Crypto Holders The integration of AI branding into malware distribution marks a significant evolution in cybercrime tactics. As artificial intelligence tools become central to professional workflows, attackers are capitalizing on the urgency users feel to access these tools. The use of AES-256-CBC encryption for the payload ensures that the core malware logic remains hidden from casual inspection and basic antivirus scanners that do not perform deep behavioral analysis. Security experts advise users to verify the source of any desktop application, particularly those claiming to offer free access to paid services. Standard precautions include downloading software only from official vendor websites, keeping operating systems and antivirus definitions updated, and using hardware wallets for significant crypto holdings to isolate private keys from internet-connected devices. The presence of a CAPTCHA in the infection chain also suggests that automated security tools may flag the behavior, but human interaction is required to complete the compromise, highlighting the persistent threat of social engineering in the cryptocurrency sector. What Is the Fake Claude App Described in the Report? The fake app is a trojanized Electron application named "Claude Opus 5 Free Desktop" that uses Anthropic’s branding to trick users into installing malware. It does not provide AI services but instead silently deploys RevStealer to steal sensitive data. Which Specific Cryptocurrency Wallets Are Targeted by Revstealer? The malware is designed to harvest data from more than 50 different cryptocurrency wallet applications, along with web browsers and password managers, to extract private keys and login credentials. How Does the Malware Evade Security Detection on Windows? RevStealer uses AES-256-CBC encryption to hide its payload, adds its folder to Microsoft Defender exclusions, and performs anti-debugging checks that wipe its code if it detects a pause in execution longer than 100 milliseconds. What Are the System Requirements for the Malware to Execute? The loader requires a computer with at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter to proceed with the infection. How Can Users Protect Themselves from This Specific Threat? Users should avoid downloading unverified software from third-party sites, verify application sources, and consider using hardware wallets to keep private keys offline and away from potential malware on their main computer.