Organization

Morphisec

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 1, 2026 · last 9d ago

Timeline2 articles

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker NewsSep 6, 08:34 UTC · 9d agoMalware in the wild

Fake Claude Opus 5 app delivers malware and wipes its own tracks

A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.

Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.

Help Net SecuritySep 1, 00:00 UTC · 14d agoMalware

Appears with

vendor Anthropic 2 organization Anthropic 2 malware RevStealer 2 ai model Claude Opus 5 2 malware Lumma Stealer 1 malware ProManager 1 malware SoftManager 1 malware VoidStealer 1 malware WinUpdate 1 organization Elastic Security Labs 1 organization Gen Digital 1 product Claude 1 product Claude Opus 5 1 product Claude-Opus-5-Free-Desktop 1 product CMSTP 1 product Microsoft Defender 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.