Fake 'Claude' Desktop App Distributes Crypto-Stealing Malware, Researchers Say

Fake 'Claude' App Used to Distribute Crypto-Stealing Malware

A desktop application impersonating Anthropic's Claude AI has been found distributing a malicious program called RevStealer, which is designed to steal data from more than 50 cryptocurrency wallets, password managers, and web browsers on Windows computers, according to a report from cybersecurity company Morphisec on Aug. 31.

The malware is delivered through a trojanized Electron application presented as "Claude Opus 5 Free Desktop," which uses Anthropic's branding and offers free access to its paid artificial intelligence model. Before appearing under the Claude name, the malware was distributed through GitHub repositories and websites advertising video game cheats, according to Morphisec Threat Labs. The researchers identified the Claude-themed GitHub project as the most notable example because it used interest in paid AI tools to encourage people to install unverified software.

The download arrives as an archive of about 101 megabytes containing a 64-bit Electron application. Although victims expect a working Claude interface, Morphisec found that the program opens no visible window and instead prepares an encrypted native payload in the background.

Technical Details and Anti-Analysis Measures

RevStealer's loader stores the payload as an AES-256-CBC-encrypted resource inside the application. After clearing its initial checks, it decrypts the file, writes it under a random name in the Windows AppData directory, and launches the malware without displaying a window. The loader also attempts to add the user's AppData folder to the Microsoft Defender exclusion list, a process designed to limit evidence left on the device while allowing the malware to collect and transmit information quickly.

Instead of immediately releasing its main payload, RevStealer first examines the computer for signs that security researchers are watching it. The loader requires at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter. It also examines the computer's language settings and shuts down on systems configured for Russian, Ukrainian, and several Central Asian languages.

A separate timing test measures the delay around a JavaScript debugger instruction, wiping the malware's encoded string table when execution pauses for more than about 100 milliseconds. Morphisec also identified 14 indirect system-call wrappers that allow the malware to reach the Windows kernel while avoiding exported functions commonly monitored by security products.

"Every stage of it is engineered around the assumption that something is watching," Morphisec researcher Shmuel Uzan wrote.

Targets and Behavior

Morphisec confirmed that RevStealer's collection list includes Windows Credential Manager, 12 password managers, more than 50 cryptocurrency wallets, and browser session cookies. The malware can also capture screenshots and selected documents. RevStealer can recover an alternative server address from a smart contract on the Polygon blockchain when its main command-and-control server becomes unavailable.

Unlike malware that creates scheduled tasks or startup entries to remain on a computer, RevStealer does not establish persistence. Morphisec described the operation as a "single short burst of theft," warning that the credentials, cookies and wallet material may already be gone by the time a detection system produces an alert for review.

Broader Context

The report follows a separate July campaign that used lookalike meeting pages and compromised Telegram accounts to target crypto workers, according to Morphisec. Kaspersky earlier identified a modular malware framework called OkoBot that used fake recovery screens, keylogging, and clipboard monitoring against cryptocurrency investors.

Federal authorities previously seized five internet domains supporting an operation distributing malware like LummaC2, while Microsoft said it helped disrupt about 2,300 domains that formed part of the malware's infrastructure. "Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft," Matthew Galeotti, then-head of the Justice Department's Criminal Division, said at the time.