New RevStealer malware spreads as fake Claude Opus 5 desktop app

RevStealer malware is being distributed through trojanized Electron applications, including a GitHub project masquerading as a free desktop version of Anthropic’s Claude Opus 5.

The malware steals browser data, password-manager files, cryptocurrency wallets, credentials, and documents while using multiple techniques to reduce its footprint and evade analysis.

Morphisec analyzed the campaign’s Electron loader and decrypted native payload, reconstructing the infection chain, anti-analysis checks, credential-collection mechanisms, command-and-control (C2) system, and cleanup routines.

One documented lure was the GitHub repository claude5opus/Claude-Opus-5-Free-Desktop, which used Claude branding and offered a roughly 101MB archive named ClaudeOpus5-desktop.zip. The campaign also used game-cheat-themed websites. Morphisec cited a victim report describing silent execution from a randomly named AppData directory followed by compromises of Microsoft and EA accounts.

The malicious project impersonates Anthropic, the company behind Claude, but there is no indication that Anthropic itself was compromised. GitHub serves only as one distribution channel identified in the campaign.

Running the enclosed Electron application starts a loader with no visible interface. It checks for sufficient memory, CPU cores, and recognized graphics hardware while screening usernames and hostnames associated with malware-analysis environments. It then attempts to add %USERPROFILE%\AppData to Microsoft Defender’s exclusion list using hidden PowerShell.

An encrypted resource named app-ri9icle2.res is decrypted with AES-256-CBC and written as %USERPROFILE%\AppData.9qdz1mlg\tk6pm8x57t.exe. The native RevStealer payload subsequently uses concealed API resolution, encrypted runtime strings, indirect Windows system calls, and additional VM and sandbox checks.

RevStealer targets Chromium and Firefox browser data, Windows Credential Manager, more than 50 cryptocurrency wallets, password managers (including Bitwarden, 1Password, KeePass, and LastPass), VPN configurations, remote-access tools, messaging applications, game launchers, screenshots, clipboard contents, and selected documents. Some stolen databases and encrypted vault or wallet files are collected raw for likely processing away from the infected system rather than decrypted locally.

Its primary C2 is meta7[.]archscreen68[.]one:443. If that infrastructure is unavailable, RevStealer queries a Polygon smart contract through public RPC providers to retrieve a replacement server address, allowing operators to change C2 infrastructure without rebuilding the malware.

Users should avoid downloading unofficial “free” versions of paid AI software, particularly executables from unverified repositories. Defenders can monitor for unexpected Defender exclusions covering AppData, the reported mutex Global\5B908BC4, the identified staging path, and the report’s C2 indicators. Systems confirmed infected should be treated as compromised, with exposed passwords, browser sessions, and relevant access tokens revoked or rotated.