Fake Claude App Spreads Malware Targeting Over 50 Crypto Wallets

A new strain of Windows malware called RevStealer is spreading through a fake 'Claude Opus 5 Free Desktop' application that impersonates AI developer Anthropic and promises free access to Claude. The researchers at Morphisec noted that the malware targets over 50 cryptocurrency wallets alongside browser passwords, cookies, messaging data, and selected documents.

RevStealer was previously distributed through GitHub repositories and game-cheat-themed sites, but the most notable method is this fake application. The malware checks whether the machine looks like a real user device before unlocking its malicious payload, looking at available memory, processor cores, hostname, username, and graphics hardware.

If RevStealer detects anything out of the ordinary, it does not move on to the next stages of infection and malicious activity. This indicates that the malware is designed to leave few traces and evade detection. The report follows a similar discovery by Russian cybersecurity company Kaspersky of a new malware framework targeting cryptocurrency investors called OkoBot.