Cybersecurity researchers have identified a campaign distributing RevStealer malware through a fake desktop application that impersonates Anthropic’s Claude AI tool. The lure, presented as “Claude Opus 5 Free Desktop,” promises free access to the paid AI model while delivering a stealthy information stealer focused on cryptocurrency wallets and account credentials.

The malware primarily affects Windows systems. It arrives as a sizable archive containing a 64-bit Electron application that opens no visible interface. Instead, it prepares and launches an encrypted native payload in the background after performing a series of environment checks.

Delivery Method and Social Engineering

RevStealer was previously spread through GitHub repositories and websites promoting video game cheats. The shift to a Claude-themed project marks a notable evolution in distribution tactics. Attackers leveraged interest in popular AI software by using Anthropic branding and the promise of free access to encourage users to download and install unverified software from unofficial sources.

Once installed, the loader stores an AES-256-CBC-encrypted payload as a resource. After clearing initial checks, it decrypts the file, writes it under a randomly generated name in the Windows AppData directory, and executes it covertly. The process also attempts to add the AppData folder to the Microsoft Defender exclusion list to reduce the chance of detection.

Environment Checks and Evasion Techniques

RevStealer is engineered to activate only on systems that appear to belong to real users rather than researchers or automated analysis setups. The loader requires a minimum of 2 gigabytes of physical memory, at least two logical processor cores, and a recognized graphics adapter. It compares the hostname and username against known research-system indicators and measures timing delays around debugger instructions. Excessive pauses cause the malware to wipe its encoded string table and halt further activity.

Additional native-stage checks produce a weighted anti-virtual-machine score. The malware also examines language settings and stops on systems configured for Russian, Ukrainian, or several Central Asian languages. In some cases, a CAPTCHA window requiring user interaction serves as another barrier. If any check fails, the payload remains encrypted and unexecuted, limiting the observable malicious behavior available to analysts.

When checks pass, RevStealer resolves Windows APIs without a standard import table and uses indirect system-call wrappers to reach the kernel while avoiding commonly monitored functions.

Data Targeted by the Malware

On systems that pass the filters, RevStealer conducts a broad search for valuable information. It examines browser databases, encryption keys, and extension storage for session cookies and credentials. Collection targets include Windows Credential Manager, multiple password managers, VPN and remote-access configurations, messaging application data, clipboard contents, screenshots, selected documents, game launchers, and OBS streaming profiles.

Cryptocurrency assets form a primary focus. The malware is designed to extract data from more than 50 cryptocurrency wallets. Stolen browser cookies can allow reuse of authenticated sessions even when multi-factor authentication is enabled, potentially granting access without needing the original password or second factor.

Collected data is packaged into encrypted, typed records and transmitted to a command-and-control server. If the primary server becomes unavailable, the malware can retrieve an alternative address from a smart contract on the Polygon blockchain. Unlike many threats, RevStealer does not establish persistence through scheduled tasks or startup entries. It gathers available information in a single operation, sends it to operators, and then removes itself from the device.

Context of Rising Crypto-Focused Threats

The RevStealer campaign coincides with other recent discoveries of malware aimed at cryptocurrency users. Separate research has detailed frameworks that harvest wallet files, inject malicious browser extensions, capture wallet application windows, and present fake recovery interfaces for hardware devices. Additional campaigns have distributed stealers through pirated media downloads and USB-based clippers that alter clipboard data to redirect transactions.

These incidents illustrate a pattern in which attackers combine realistic software branding with environment-aware execution and rapid data exfiltration. Users are advised to treat unexpected free desktop applications—particularly those claiming association with major AI or productivity tools—as high risk and to verify software integrity through official channels before installation.