A trojanized desktop application posing as a free version of Anthropic’s Claude AI model is being used to deliver RevStealer malware on Windows, according to reporting on the campaign. The fake program is presented as “Claude Opus 5 Free Desktop” and uses Anthropic branding to lure downloads.
Once launched, the app reportedly runs in the background without opening a visible window, decrypts a hidden payload, and deploys malware built to collect sensitive data from browsers, password tools, and cryptocurrency wallets. The operation targets more than 50 crypto wallets and 12 password managers, along with other account and system data.
Fake AI app used as malware delivery vehicle
The malicious installer is described as an Electron-based 64-bit application distributed in an archive of roughly 101 megabytes. Rather than functioning as a normal desktop app, it prepares an encrypted native payload behind the scenes.
That payload is stored as an AES-256-CBC-encrypted resource. The loader decrypts it, writes it into the Windows AppData directory under a random name, and launches it without showing a window to the user. It also attempts to add the user’s AppData folder to the Microsoft Defender exclusion list, a step that could reduce the chance of detection.
Checks designed to avoid sandboxes and virtual machines
Before exposing the malware payload, the loader checks whether the machine appears suitable for execution. It requires at least 2 GB of physical memory, two logical CPU cores, and a recognized graphics adapter.
The campaign also uses several anti-analysis techniques. These include hostname and username checks against a blocklist, a JavaScript debugger timing test, language-setting checks, a weighted anti-virtual-machine routine, and a CAPTCHA prompt intended to frustrate automated analysis. If those checks fail, the payload is not decrypted or revealed.
Wallets, passwords, cookies and other data are in scope
On systems that pass the checks, RevStealer searches browser databases, encryption keys, and extension storage for material that could help attackers access online accounts. The reported collection set includes Windows Credential Manager, browser session cookies, 12 password managers, and more than 50 cryptocurrency wallets.
The malware also looks for VPN configurations, remote-access credentials, clipboard contents, messaging data, documents, screenshots, game launchers, and OBS profiles. The data is packaged into encrypted records and sent to the operator’s command-and-control infrastructure.
One of the more serious risks comes from stolen session cookies. If an account is already authenticated, a reused cookie may allow access even when multi-factor authentication is enabled.
Malware removes itself after exfiltration
RevStealer is not described as establishing persistence on the infected device. Instead, it appears designed for fast collection and theft: gather data, transmit it, and then remove itself from the system.
The malware can also recover an alternative server address from a Polygon smart contract if its primary command-and-control server is unavailable. That capability could let operators change infrastructure without rebuilding the malware. The confirmed next step for users and defenders is caution around unofficial Claude desktop downloads on Windows, especially offers claiming free access to paid AI models.
Source: crypto.news