.jpg)
RevStealer, a Windows malware strain hidden inside a fake "Claude Opus 5 Free Desktop" app, is being used to steal data from more than 50 cryptocurrency wallets, 12 password managers and every major browser — a campaign that weaponizes demand for paid AI tools to drain crypto users before most security software notices anything happened.
Cybersecurity company Morphisec detailed the operation in an Aug. 31 report, describing a trojanized Electron application that borrows Anthropic's Claude branding and promises free access to a paid AI model. Before appearing under the Claude name, the malware was distributed through GitHub repositories and video game cheat sites, but the AI-themed lure marks an escalation: it targets the exact demographic — curious, cost-conscious tech users — most likely to hold crypto wallets and password managers on a Windows machine.
How RevStealer gets in
The download arrives as an archive of roughly 101 megabytes containing a 64-bit Electron application. Victims expect a working Claude interface; instead, the program opens no visible window and prepares an encrypted native payload in the background. The payload is stored as an AES-256-CBC-encrypted resource, decrypted after initial checks, written under a random name in the Windows AppData directory and launched without a window. Simultaneously, the loader attempts to add the user's AppData folder to the Microsoft Defender exclusion list — quietly telling the operating system's own antivirus to look the other way.
That exclusion trick is becoming a signature of modern credential theft. The July BlueNoroff campaign added the same Defender exclusion on Windows while collecting Chrome master keys from Apple's Keychain on macOS, and the wave of fake-software lures keeps growing.
RevStealer watches for whoever is watching it
What distinguishes RevStealer is the depth of its anti-analysis engineering. The loader requires at least 2 gigabytes of physical memory, two logical processor cores and a recognized graphics adapter. Hostname and username checks compare the device against a blocklist associated with research systems, and a timing test measures delay around a JavaScript debugger instruction — wiping the malware's encoded string table if execution pauses for more than about 100 milliseconds. The native stage runs another 10 checks producing a weighted anti-virtual-machine score, examines language settings and shuts down on systems configured for Russian, Ukrainian and several Central Asian languages. A CAPTCHA window blocks automated sandboxes from proceeding.
"Every stage of it is engineered around the assumption that something is watching," Morphisec researcher Shmuel Uzan wrote. Once running, the malware resolves Windows APIs without a standard import table and uses 14 indirect system-call wrappers to reach the kernel while avoiding the functions security products monitor.
Wallets, cookies and the MFA bypass
On an accepted device, RevStealer sweeps browser databases, encryption keys and extension storage, plus Windows Credential Manager, 12 password managers, more than 50 crypto wallets, VPN configurations, remote-access credentials, clipboard contents, messaging data, screenshots, game launchers and OBS streaming profiles. Each source is packaged into encrypted, typed records and sent to the operator's command-and-control server — with a fallback address recoverable from a smart contract on the Polygon blockchain if the main server goes dark, letting operators rotate infrastructure without rebuilding the malware.
The most dangerous item on that list is the humble session cookie. A stolen cookie can expose an account even when the owner uses multi-factor authentication: if a session has already passed login, a criminal can reuse the cookie and skip the victim's password and second factor entirely. RevStealer establishes no persistence — it collects, transmits and deletes itself, which Morphisec described as a "single short burst of theft" that may be complete before any detection system raises an alert.
Fake software remains crypto's favorite trap
The Claude impersonation is the latest entry in a crowded genre. Fake The Odyssey movie downloads delivered Lumma Stealer in August; Kaspersky identified the 20-module OkoBot framework targeting crypto investors in July; and lookalike meeting pages have targeted crypto workers across Windows and macOS. The lesson is identical each time: official software comes from official sources — and "free version" of a paid product is almost never a gift. Users who suspect exposure should rotate passwords from a clean device, revoke active sessions, move funds from any wallet whose software or credentials touched the infected machine, and treat MFA as a floor rather than a ceiling. Infrastructure exploits get the headlines, but most crypto losses still begin with a download the victim chose to make.
