Fake Claude Desktop App Spreads RevStealer Malware Targeting Crypto Wallets And Passwords

Fake Claude App Exploits Demand For Free AI Access To Steal Crypto And Passwords

A download promising free access to Anthropic’s paid Claude AI model is being used to deliver Windows malware capable of stealing cryptocurrency wallets, passwords and other sensitive data.

Cybersecurity firm Morphisec said its Threat Labs identified the campaign as part of the distribution of RevStealer, an information-stealing malware previously spread through GitHub repositories and websites offering video game cheats.

The most notable campaign centres on a malicious GitHub project named “Claude-Opus-5-Free-Desktop”.

It presents itself as a way to access “Claude Opus 5” for free and provides a roughly 101MB download called ClaudeOpus5-desktop.zip.

The software is packaged as a 64-bit Electron application and uses Anthropic’s branding to appear legitimate. Instead of opening a working Claude interface, however, the application runs malicious processes in the background.

RevStealer Targets Crypto Wallets And Passwords

Once active, RevStealer searches a Windows computer for a wide range of information that could give attackers access to accounts and digital assets.

The malware can collect browser databases, session cookies, saved credentials, password-manager data, Windows Credential Manager entries, VPN and remote-access credentials, messaging application data and game launcher accounts.

It also searches files linked to more than 50 cryptocurrency wallet applications, while targeting clipboard contents, screenshots, OBS streaming profiles and selected documents.

Morphisec said the malware is built to operate quietly and leave as little evidence as possible.

Rather than creating one large archive containing stolen information, it can send encrypted records directly to its command-and-control server.

The malware can also download and run additional files or execute commands supplied by its operators. Some actions may request elevated Windows permissions and trigger a User Account Control prompt, although the malware does not bypass UAC.

How Does RevStealer Avoid Detection?

RevStealer does not immediately begin collecting information after installation.

Its loader first checks whether the computer looks like a genuine user device or a system being used by security researchers to analyse malware.

The checks cover available memory, processor count, hostname, username, graphics hardware, running processes, system uptime and other system characteristics.

The malware also looks for debugging tools, virtual machines and other signs of an analysis environment.

If enough suspicious indicators are found, RevStealer stops running instead of continuing with the infection.

The malware can also display a fake verification window containing a randomly generated challenge code.

A failed response or closing the window can terminate the process.

Morphisec said the malware had been detected by only one of 66 antivirus engines when it was checked in the report, showing how its techniques can help it avoid conventional detection.

On supported Chrome and Edge installations, RevStealer can use debugger-based techniques to obtain browser encryption keys stored in memory, allowing it to access data protected by newer App-Bound encryption.

A Polygon Smart Contract Provides A Backup Route

The campaign also uses blockchain infrastructure as part of the malware’s command-and-control system.

If its main server becomes unavailable, RevStealer can retrieve a secondary server address from a smart contract on the Polygon blockchain.

This gives its operators a way to update their infrastructure without rebuilding and redistributing the malware.

The malware also uses encrypted configuration data, indirect system calls and other techniques intended to make analysis and monitoring more difficult.

Morphisec said the native payload can resolve Windows APIs without a conventional import table and use 14 indirect syscall wrappers to bypass user-mode monitoring hooks.

It can also register a vectored exception handler around its data-collection routines, allowing individual failures during the theft process without necessarily ending the entire operation.

The Claude Lure Is Part Of A Wider Malware Problem

The fake Claude campaign follows other recent efforts to target cryptocurrency users with information-stealing malware.

Russian cybersecurity company Kaspersky recently reported OkoBot, a malware framework capable of harvesting crypto wallet files, browser information and user credentials.

It can also inject malicious browser extensions and capture wallet application windows.

In the US, federal authorities have also taken action against LummaC2, another malware operation used to steal credentials and cryptocurrency wallet information.

The US Department of Justice said in May 2025 that LummaC2 had been linked to at least 1.7 million information-theft incidents.

The RevStealer campaign shows how attackers are using familiar software names and free-access offers to make malware downloads appear credible.

A legitimate-looking GitHub project can therefore become the first step in an attack that moves from a fake AI application to the theft of passwords, browser sessions and cryptocurrency assets.