Hackers are using a fake Claude Opus 5 desktop application to distribute RevStealer, a Windows malware built to take passwords, browser data and cryptocurrency wallet material.
The campaign turns demand for AI tools into a trap, giving victims a reason to download an archive from a useful-looking project. The lure is a “Claude Opus 5 Free Desktop” GitHub project that claims free access to a paid AI model.
RevStealer has also appeared through game-cheat-themed websites, showing how attackers can reuse the malware behind different promises and reach users downloading unverified software. Morphisec researchers identified the operation and found that the malware is designed to leave little behind after it runs.
Morphisec said in a report shared with Cyber Security News (CSN) that the threat is delivered through a trojanized Electron desktop app that impersonates legitimate software.
Impact extends beyond saved passwords. RevStealer searches browser databases, cookies, password-manager records, VPN and remote-access settings, messaging data, screenshots and selected documents.
Its focus on more than 50 cryptocurrency wallets means an infection may expose assets that cannot be recovered once transferred.
Hackers Hide RevStealer Inside Fake Claude Opus 5 App
Victims are directed to download an archive of about 101 MB, but the included 64-bit Electron program does not provide a working desktop interface. Instead, it checks whether the machine looks like a real user device before unlocking its payload, making the lure risky for people seeking unofficial AI downloads.
The loader checks available memory, processor cores, hostname, username and graphics hardware. It also watches for debugging delays.
If the environment seems automated or under analysis, it withholds the next stage, much like other fake AI tool campaigns that abuse trusted-looking repositories instead of obvious malicious attachments.
On a system that passes the checks, the program decrypts an AES-256-CBC payload stored in its resources. It writes that component into a randomly named AppData folder, runs it without a visible window and tries to remove its staging file.
Researchers also observed an attempt to add the user’s AppData directory to Microsoft Defender exclusions. The native component then performs more virtual-machine checks, stops on certain regional language settings and displays a CAPTCHA to frustrate automated analysis.
It can continue collecting data even if one collector fails. This layered approach shows why a harmless-looking download can become an immediate credential-theft event after one execution.
Silent Theft and Defensive Steps
RevStealer collects information in short encrypted records and sends it out without building a large archive on disk. It uses concealed Windows API resolution and indirect system calls to reduce the clues security products commonly observe.
Similar pressure on browser sessions and wallet data appeared when compromised browser extensions stole credentials, reinforcing the value of protecting active sessions as well as passwords.
The malware does not need a scheduled task, Run key or startup entry to do damage. Its operators aim for a brief theft window, then self-delete.
If its primary command-and-control server is unavailable, it can obtain a replacement address through a Polygon smart contract, making infrastructure changes harder to disrupt through server takedowns.
Users should avoid “free” versions of paid AI products, especially installers promoted through unverified repositories, release pages or gaming communities.
Download software only from official channels, inspect a project’s ownership and release history, and treat an application that offers no visible interface as suspicious.
The same caution applies to AI-assisted GitHub repository lures, which use polished documentation to manufacture trust. Organizations should block execution from risky user-writable locations, monitor attempts to alter antivirus exclusions and require stronger sign-in protection.
Teams should revoke exposed sessions, reset passwords and move cryptocurrency funds when compromise is suspected. Fast containment matters because the malware’s lack of persistence does not make stolen data less valuable.
For defenders, the key lesson is to stop execution before theft begins. Controls that restrict untrusted downloads, verify software sources and flag unusual browser or wallet-data access can reduce exposure. Regular extension reviews also help prevent password and wallet theft.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hackers Hide RevStealer Inside Fake Claude Opus 5 App to Steal Passwords and Crypto appeared first on Cyber Security News.