Malware Impersonates AI Developer to Steal Crypto Assets

A new malware campaign is targeting cryptocurrency investors by impersonating AI developer Anthropic's desktop application Claude. The fake 'Claude Opus 5 Free Desktop' project promises free access to Claude, but actually delivers RevStealer, a Windows malware family designed to harvest sensitive information and steal crypto assets.

According to cybersecurity firm Morphisec, the campaign has evolved beyond earlier distribution methods that relied on GitHub repositories and game-cheat-themed sites. The malware focuses on stealth, searching browser data, cookies, password-manager records, VPN/remote-access settings, and selected files. It targets over 50 cryptocurrency wallets and attempts to avoid analysis by checking for 'real user' environments.

The RevStealer infection chain includes a multi-part gating mechanism that checks whether the machine resembles a genuine user device. If it detects anything abnormal, it does not proceed further, which can reduce observable behavior available to analysts and slow down detection efforts.