Cybersecurity company Morphisec has discovered that attackers are disguising the Anthropic desktop application under the name "Claude Opus 5 Free Desktop" to deploy the information-stealing trojan RevStealer on Windows systems; public evidence shows this is a counterfeit distribution activity, with no signs of intrusion into Anthropic systems.

The bait is spread through GitHub projects and gaming cheat theme websites. The malicious project offers a 101MB "ClaudeOpus5-desktop.zip" package containing a 64-bit Electron program; when run, it does not provide a usable Claude interface but acts as a loader in the background, decrypting and executing hidden native malicious payloads.

RevStealer can collect databases from Chromium and Firefox browsers, saved passwords, cookies, extension storage, and encryption keys, targeting Windows Credential Manager, 11 types of password managers, 6 types of VPN services, remote access and FTP software, instant messaging applications, game launchers, OBS configurations, clipboard, screenshots, as well as specific files in the desktop, documents, downloads directory, and cloud storage.

This sample specifically targets 51 types of cryptocurrency wallets and related browser extension files, including wallet databases, key materials, and encrypted vault files; some data is exfiltrated in raw form, allowing attackers to further process it outside the victim's device. Theft of wallet files does not necessarily mean assets are immediately transferred, but if mnemonic phrases, private keys, browser sessions, or unlock credentials are leaked simultaneously, assets face irreversible transfer risks.

RevStealer is designed with anti-sandbox and anti-analysis features. The loader checks if the memory is at least 2GiB, if there are at least 2 logical CPU cores, if specific graphics card adapters exist, and whether the username or hostname matches any of 14 keywords on an interception list, including "sandbox"; if the checks fail, the malicious payload may not continue to decrypt or execute.

The sample also attempts to add the AppData directory to Microsoft Defender's exclusion list, then writes and runs the decrypted payload in that directory; data is continuously sent to servers controlled by the attackers in small batches, rather than first being packaged into large compressed files on disk. Researchers state that its backup C2 address can be read from a smart contract on the Polygon chain, reducing the impact of a single server going offline on the attack chain.

Users should not download AI software like Claude from GitHub repositories, third-party download sites, or "free premium version" or "cracked version" pages. If related files have already been run, they should immediately disconnect from the internet, change passwords for browsers, emails, exchanges, and password managers on another trusted device, and revoke active sessions; cryptocurrency assets should be transferred to a new address controlled by a wallet created on an uninfected device, and authorization and API keys should be checked.

In market mechanisms, attackers lower victims' vigilance with "free frontier model desktop versions" to monetize browser sessions, password managers, wallets, and remote access credentials; cryptocurrency assets are high-value targets due to their irreversible transfers, cross-border nature, and rapid aggregation. Beneficiaries include official software distribution channels, endpoint security, and hardware wallet providers; those under pressure are individuals and small teams relying on browser hot wallets, storing mnemonic phrases on the same device, reusing passwords, or never verifying repository sources.

Source: Public information