Cybersecurity researchers have uncovered a new campaign leveraging a counterfeit desktop app called “Claude Opus 5 Free Desktop” to deliver RevStealer, a potent Windows malware engineered to harvest browser credentials, crypto-wallets, passwords, and other sensitive data. The threat operators are preying on demand for advanced AI tools by presenting the app as a free version of a paid model, hiding malicious payloads in convincing archives.
How the Attack Works
The attackers deploy a GitHub project that purports to offer a free desktop client for AI tool Claude Opus 5. Users are instructed to download a 101 MB archive containing a 64-bit Electron application. Despite appearing legitimate, the application lacks a usable interface and instead applies environmental checks—such as CPU cores, memory availability, graphics hardware, hostname and username—to determine if it’s running on a real user device. In virtualized or debugging labs, the payload remains locked.
Once the app passes these checks, it decrypts a hidden AES-256-CBC payload, places it in a randomly named folder under the user’s AppData directory, and executes it without any visible window. It also tries to exclude its folder from Microsoft Defender. The malware performs additional checks for virtual machines, skips certain regional language settings, and displays a CAPTCHA to derail automated analysis.
Data Harvest and Evasion Techniques
RevStealer is constructed for silent, efficient data theft. It targets over fifty popular cryptocurrency wallets, browser cookies, password managers, VPN and remote access configurations, messaging databases, screenshots, and selected documents. Even when one data collector fails, others still operate—demonstrating how robust its layered design is.
The malware sends encrypted records of stolen data in small chunks without aggregating large files on disk. It uses less obvious Windows API resolution and indirect system calls to avoid raising alarms from security tools. Notably, it leaves no startup registry keys, scheduled tasks, or persistent services—its strategy is to strike quickly and then self-delete. If the main command-and-control address is taken down, RevStealer is able to fetch backup infrastructure using a smart contract on the Polygon blockchain, making remediation more complex.
Defensive Measures and What Users Should Do
To guard against this threat, users should strongly avoid free versions or cracked variants of paid AI tools, especially if the software comes via unverified repos, gaming forums, or other third-party sources. Always check whether a project has legitimate release history, verifiable ownership, and is distributed through official channels. Suspicion should spike if the app launches without a user interface.
Organizations should enforce policies blocking execution of software in user writable locations, monitor attempts to modify antivirus exclusions, and tighten protections around browser sessions and wallet data. In the event of suspicion, revoking compromised sessions, resetting passwords, and relocating cryptocurrency assets are crucial—even though RevStealer doesn’t sustain itself long-term.
The core challenge here is catching this kind of attack early. Strategies that block untrusted downloads, validate software signatures, and flag unusual system or wallet-data access will reduce exposure. Performing regular extension audits and keeping threat intelligence feeds up to date also enhance detection.
Taken together, this campaign is a stark reminder: the allure of “free” tools can be a facade hiding major risk. Vigilance pays off far more than convenience in today’s threat landscape. Watch closely for where you download software, what it tries to access—and expect attackers to keep pushing creative ways to exploit trust.
