Fake Claude App Spreads RevStealer Malware Targeting Crypto Wallets

A malicious app called 'Fake Claude' has been spreading RevStealer malware that targets over 50 cryptocurrency wallets and 12 password managers on Windows computers. The malware is hidden inside a fake desktop application called 'Claude Opus 5 Free Desktop,' which uses Anthropic's branding to lure users in.

Once installed, the malware examines the computer for signs of security researchers watching it. It requires at least 2GB of physical memory and two logical processor cores to run. If the device passes the checks, RevStealer collects information from browser databases, encryption keys, and extension storage, sending it in encrypted records to its operators' command-and-control server.

The malware does not establish persistence on the computer, instead removing itself after collecting the available information. Morphisec described the operation as a 'single short burst of theft,' warning that credentials, cookies, and wallet material may already be gone by the time a detection system produces an alert for review.