RevStealer Malware Spreads Through Fake Claude Opus 5 Download

A new Windows infostealer dubbed RevStealer is spreading through GitHub repositories and game cheat websites, targeting browser data, cryptocurrency wallets, and password managers. The malware is disguised as a free version of Anthropic's Claude Opus 5 model, which is actually a fake download from the repository claude5opus/Claude-Opus-5-Free-Desktop.

Once installed, RevStealer performs anti-sandbox checks to evade detection by endpoint security systems. It also conceals its Windows API resolution and behavior from static analysis by encrypting strings and configuration information. If the main C2 server becomes unavailable, the malware sends Polygon JSON-RPC eth_call requests to a smart contract on the Polygon blockchain containing a fallback address.

The infostealer targets browser databases, wallet files, password-manager artifacts, session tokens, cryptocurrency wallets, VPN and remote-access credentials, gaming profiles, messaging applications, user documents, and more. It streams stolen data to an attacker-controlled server as it becomes available in memory without staging a large archive on disk.

According to Morphisec Security Researcher Shmuel Uzan, 'RevStealer is not novel in what it steals. Browser databases, wallet files, password-manager artifacts and session tokens have been the standard haul for years.' The malware's collectors write the stolen content to in-memory buffers, encrypts it with AES-128-CBC, and then base64-encodes the result.