Fake Claude App Spreads RevStealer, Targeting 50 Crypto Wallets

The fake Claude desktop application has been used to spread the Windows malware RevStealer, which can steal crypto assets, passwords, and browser data, targeting over 50 crypto wallets. Cybersecurity company Morphisec reported that RevStealer was previously distributed through GitHub repositories and gaming cheat forums, this time disguised as the "Claude Opus 5 Free Desktop" project, impersonating AI developer Anthropic and promising free access to Claude. The malware searches browser databases, cookies, password manager records, VPN and remote access settings, chat data, screenshots, and specific documents, while checking device memory, processor core count, hostname, username, and graphics hardware. RevStealer monitors debugging delays in malware analysis environments and will not continue the infection process if anomalies are detected; after inspection, its payload is decrypted, stored under a random name, and executed covertly. Previously, Russian cybersecurity company Kaspersky discovered a malware framework called OkoBot targeting crypto investors, capable of stealing wallet files, browser data, and user credentials.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.