Hackers Distribute RevStealer Malware via Fake Claude Opus 5 Desktop App
Attackers are luring users with a fake Claude Opus 5 desktop application, distributing the RevStealer infostealer malware designed to steal passwords, browser data, and cryptocurrency.
Cybercriminals are actively distributing a potent information-stealing malware, dubbed RevStealer, by masquerading it as a free desktop application for the advanced AI model Claude Opus 5. This deceptive campaign exploits the high demand for accessible AI tools, enticing unsuspecting users to download a trojanized Electron application from a seemingly legitimate GitHub project. The lure promises free access to a paid AI model, but instead delivers a sophisticated malware payload.
Researchers at Morphisec identified this operation, noting that the malware is meticulously designed to minimize its digital footprint after execution. The threat is delivered via a trojanized Electron desktop app that mimics legitimate software. Once installed, RevStealer embarks on a comprehensive data theft mission. It targets not only saved passwords and browser cookies but also cryptocurrency wallet information, VPN and remote-access settings, messaging data, screenshots, and sensitive documents. The malware's specific focus on over 50 cryptocurrency wallets poses a significant risk of irreversible financial loss for infected users.
The campaign involves users downloading an archive of approximately 101 MB. The included 64-bit Electron program, however, does not present a functional desktop interface. Instead, it first performs a series of environment checks to determine if the host machine is a genuine user device or an analysis environment. These checks include evaluating available memory, processor cores, hostname, username, graphics hardware, and monitoring for debugging delays. If the environment is detected as automated or under analysis, the malware withholds its payload, a tactic also observed in other fake AI tool campaigns that leverage trusted-looking repositories.
On systems that pass these initial checks, the program decrypts an AES-256-CBC payload stored within its resources. This payload is then written to a randomly named folder in the AppData directory, executed without a visible window, and the staging file is attempted to be removed. The malware also exhibits an attempt to add the user's AppData directory to Microsoft Defender exclusions, indicating a sophisticated effort to evade security software. Further anti-analysis measures are employed by the native component, including additional virtual machine checks and sensitivity to regional language settings.
RevStealer operates by collecting information in small, encrypted records and exfiltrating them without creating large archives on disk. It utilizes concealed Windows API resolution and indirect system calls to evade common security monitoring techniques. This stealthy approach is further enhanced by its ability to obtain replacement command-and-control server addresses through a Polygon smart contract, making infrastructure takedowns more challenging for defenders.
Security experts strongly advise users to avoid "free" versions of paid AI products, especially those promoted through unverified repositories or gaming communities. Downloading software exclusively from official channels, verifying project ownership and release history, and treating applications that lack a visible interface with extreme suspicion are crucial preventative measures. Organizations are urged to block execution from risky user-writable locations, monitor for attempts to alter antivirus exclusions, and enforce stronger sign-in protection.
For individuals and organizations that suspect a compromise, immediate actions such as revoking exposed sessions, resetting passwords, and moving cryptocurrency funds are critical. The malware's self-deleting nature does not diminish the value of the stolen data. The primary defense strategy lies in preventing the initial execution of the malware, highlighting the importance of robust controls that restrict untrusted downloads, verify software sources, and flag unusual data access patterns.