RevStealer Malware Hides Inside a Fake Claude Desktop App

Cybersecurity firm Morphisec has identified a Windows information-stealing malware called RevStealer that is being distributed through a fake application posing as “Claude Opus 5 Free Desktop.” The malware targets more than 50 cryptocurrency wallets, a dozen password managers and browser session data, then deletes itself after transmitting stolen information.

Malware Hides Inside a Fake AI Desktop Application

Morphisec Threat Labs said in an August 31 report that RevStealer is delivered through a trojanized Electron application that impersonates Anthropic’s branding and offers free access to a paid AI model. 

Before appearing under the Claude name, the same malware had circulated through GitHub repositories and websites advertising video game cheats, according to the report.

The download arrives as an archive of roughly 101 megabytes containing a 64-bit Electron application. Rather than opening a visible interface, the program creates no window at all and instead prepares an encrypted payload in the background. 

The loader also attempts to add the user’s AppData folder to the Microsoft Defender exclusion list before running the malware.

RevStealer Checks Its Environment Before Doing Anything

RevStealer’s loader examines the host computer before decrypting or exposing its main payload, according to Morphisec. 

It checks available memory, processor cores, graphics hardware and the device’s hostname against a list associated with known research systems, and it monitors for delays that would suggest a security researcher is stepping through the code with a debugger.

A separate native-code stage runs additional checks, shuts down on systems configured for Russian, Ukrainian or several Central Asian languages, and presents a CAPTCHA challenge that requires human interaction before continuing. Morphisec researcher Shmuel Uzan said the malware’s design assumes it is being watched. Uzan said:

“Every stage of it is engineered around the assumption that something is watching.” 

Wallets, Passwords and Browser Sessions Are the Primary Targets

Once those checks pass, Morphisec said RevStealer collects data from Windows Credential Manager, more than a dozen password managers, more than 50 cryptocurrency wallets, browser session cookies, VPN configurations, remote-access credentials, clipboard contents and messaging application data. 

The stolen information is organized into encrypted records and sent to the attacker’s server before the malware removes itself from the device, leaving no persistent trace such as scheduled tasks or startup entries.

Stolen browser cookies can allow an attacker to access an account without a password or a second authentication factor if a valid login session has already been established on the victim’s device.

Malware Falls Back on a Blockchain Smart Contract to Stay Reachable

If RevStealer’s primary command-and-control server becomes unavailable, Morphisec said the malware can retrieve an alternate server address from a smart contract on the Polygon blockchain. 

That mechanism allows the malware’s operators to change infrastructure without rebuilding or redistributing the software, complicating efforts by researchers and law enforcement to disrupt the operation by seizing domains.

Part of a Broader Pattern of Fake Software Targeting Crypto Users

The Claude impersonation follows a series of recent campaigns using familiar software branding to distribute credential-stealing malware. 

Cybersecurity firm Bitdefender identified fake downloads of the film “The Odyssey” that delivered a separate program known as Lumma Stealer through files disguised as high-definition movie releases, capable of collecting wallet data, saved passwords and browser cookies.

Separately, cybersecurity firm JUMPSEC identified a campaign linked to the North Korea-associated group BlueNoroff that used fake video-conferencing meeting pages and compromised Telegram accounts to scan victims’ browsers for Ethereum and Solana wallets. 

Cybersecurity firm Kaspersky also identified a modular malware framework called OkoBot that used fake wallet-recovery screens to capture recovery phrases from victims in Brazil, Vietnam, Canada, Mexico, and Turkey.

Federal Authorities Have Targeted Similar Infostealer Operations

U.S. authorities have previously moved against comparable malware operations. The Justice Department said in May 2025 that a separate infostealer called LummaC2 had been used in at least 1.7 million information-theft incidents before federal authorities seized five domains supporting the operation, with Microsoft assisting in disrupting roughly 2,300 additional domains tied to the malware’s infrastructure.

Then-Justice Department Criminal Division head Matthew Galeotti said at the time that malware of that kind is used “to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft.”