Fake Claude app targets 50+ crypto wallets with RevStealer

A fake Claude desktop application has distributed RevStealer malware designed to steal data from more than 50 cryptocurrency wallets, password managers, and web browsers on Windows computers.

Summary

• RevStealer is hidden inside a fake “Claude Opus 5 Free Desktop” application.
• The malware targets more than 50 crypto wallets and 12 password managers.
• System checks prevent the payload from running in some virtual machines and analysis environments.
• RevStealer sends stolen data in encrypted records before deleting itself from the device.

Fake Claude app conceals RevStealer payload

Cybersecurity company Morphisec said in an Aug. 31 report that RevStealer is being delivered through a trojanized Electron application presented as “Claude Opus 5 Free Desktop,” which uses Anthropic’s branding and offers free access to its paid artificial intelligence model.

Before appearing under the Claude name, the malware was distributed through GitHub repositories and websites advertising video game cheats, according to Morphisec Threat Labs. The researchers identified the Claude-themed GitHub project as the most notable example because it used interest in paid AI tools to encourage people to install unverified software.

The download arrives as an archive of about 101 megabytes containing a 64-bit Electron application. Although victims expect a working Claude interface, Morphisec found that the program opens no visible window and instead prepares an encrypted native payload in the background.

RevStealer’s loader stores the payload as an AES-256-CBC-encrypted resource inside the application. After clearing its initial checks, it decrypts the file, writes it under a random name in the Windows AppData directory, and launches the malware without displaying a window.

At the same time, the loader attempts to add the user’s AppData folder to the Microsoft Defender exclusion list. Morphisec said the process is designed to limit the evidence left on the device while allowing the malware to collect and transmit information quickly.

RevStealer checks the computer before running

Rather than immediately releasing its main payload, RevStealer first examines the computer for signs that security researchers are watching it. The loader requires at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter, according to Morphisec.

Hostname and username checks compare the device against a blocklist associated with research systems. A separate timing test measures the delay around a JavaScript debugger instruction, wiping the malware’s encoded string table when execution pauses for more than about 100 milliseconds.

The native stage conducts another 10 checks that produce a weighted anti-virtual-machine score. It also examines the computer’s language settings and shuts down on systems configured for Russian, Ukrainian, and several Central Asian languages.

Automated analysis faces another barrier through a CAPTCHA window, which requires interaction before the infection can continue. If the device fails one of the early checks, the loader does not decrypt or expose the payload, leaving researchers with less malicious activity to examine.

Once running, RevStealer resolves Windows application programming interfaces without using a standard import table. Morphisec also identified 14 indirect system-call wrappers that allow the malware to reach the Windows kernel while avoiding exported functions commonly monitored by security products.

“Every stage of it is engineered around the assumption that something is watching,” Morphisec researcher Shmuel Uzan wrote.

RevStealer targets crypto wallets and account sessions

On an accepted device, RevStealer searches browser databases, encryption keys, and extension storage for information that can provide access to online accounts. Morphisec confirmed that its collection list includes Windows Credential Manager, 12 password managers, more than 50 cryptocurrency wallets, and browser session cookies.

The malware also looks for VPN configurations, remote-access credentials, clipboard contents, messaging application data, selected documents, screenshots, game launchers and OBS streaming profiles. Information collected from each source is placed in an encrypted, typed record before being sent to the operator’s command-and-control server.

Stolen browser cookies can expose an account even when the owner uses multi-factor authentication. If a valid session has already passed the login process, a criminal may be able to reuse the cookie instead of supplying the victim’s password and second authentication factor, according to cybersecurity researchers cited in previous malware reporting.

RevStealer can also recover an alternative server address from a smart contract on the Polygon blockchain when its main command-and-control server becomes unavailable. Morphisec said the method lets its operators change infrastructure without rebuilding and redistributing the malware.

Unlike malware that creates scheduled tasks or startup entries to remain on a computer, RevStealer does not establish persistence. The program collects the available information, sends it to its operators, and removes itself.

Morphisec described the operation as a “single short burst of theft,” warning that the credentials, cookies and wallet material may already be gone by the time a detection system produces an alert for review.

Fake software remains a common crypto malware lure

The Claude impersonation follows several campaigns in which attackers packaged credential-stealing tools as familiar applications, entertainment files, or software updates.

In August, crypto.news reported that fake downloads of The Odyssey were delivering Lumma Stealer through Windows executable files disguised as 1080p, WEBRip, and Blu-ray movie releases. Bitdefender said the malware could collect cryptocurrency wallet data, saved passwords, payment information, browser cookies, and remote-desktop credentials.

A separate July campaign used lookalike meeting pages and compromised Telegram accounts to target crypto workers. According to reporting on fake meetings, North Korea-linked BlueNoroff operators scanned browsers for Ethereum and Solana wallets before presenting some victims with false Zoom or Microsoft Teams updates.

JUMPSEC found that the meeting campaign covered both Windows and macOS devices. On Windows, its PowerShell loader added a Microsoft Defender exclusion, while the macOS version collected system information and Chrome master keys from Apple’s Keychain.

Kaspersky identified another modular malware framework in July that used fake recovery screens, keylogging, and clipboard monitoring against cryptocurrency investors. The company said OkoBot’s 20 modules could capture wallet recovery phrases, passwords and copied wallet addresses, with affected users found in Brazil, Vietnam, Canada, Mexico and Turkey.

OkoBot’s SeedHunter component showed victims a false recovery interface associated with Ledger and Trezor devices, according to Kaspersky. Any recovery phrase entered into the screen was sent to the malware operators, while another module recorded open wallet windows.

U.S. authorities have tracked similar information theft

For users in the United States, the RevStealer report follows federal action against LummaC2, another malware service used to collect credentials and cryptocurrency wallet information.

The U.S. Justice Department said in May 2025 that LummaC2 had been used in at least 1.7 million information-theft incidents. Federal authorities seized five internet domains supporting the operation, while Microsoft said it helped disrupt about 2,300 domains that formed part of the malware’s infrastructure.

“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft,” Matthew Galeotti, then-head of the Justice Department’s Criminal Division, said at the time.

The Justice Department said the malware was sold through online forums and a Telegram channel, allowing customers to buy access and run their own theft campaigns. Court-authorized seizures redirected the five main domains to government-controlled pages, while the department said foreign and domestic partners assisted with the disruption.