Fake Claude Opus 5 app delivers malware and wipes its own tracks
A fake 'Claude Opus 5' GitHub repository impersonating Anthropic distributes RevStealer, a Windows infostealer stealing passwords, crypto wallets and VPN credentials.
Morphisec identified a malicious GitHub repository, Claude-Opus-5-Free-Desktop, impersonating Anthropic to distribute a roughly 101 MB download that launches RevStealer, a Windows information-stealing malware. The malware targets browser credentials, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN, messaging, game launcher and streaming accounts, streaming stolen data to its server before deleting itself. It evades analysis with ten sandbox and VM checks, indirect system calls, Windows Defender exclusions, a fake verification window, and a Polygon blockchain smart contract fallback for C2. Only 1 of 66 antivirus engines flagged the sample at check time.
- RevStealer resolves Windows APIs without an import table and uses indirect syscalls to bypass user-mode hooks.
- Fallback C2 address is read from a Polygon blockchain smart contract, enabling infrastructure rotation without rebuilding.
- Ten sandbox and VM checks score the environment; the malware shuts itself down when analysis is suspected.
- Bypasses Chrome and Edge App-Bound encryption via debugger control and hardware breakpoint key capture.
- Skips systems set to Russian, Ukrainian or Central Asian languages as an anti-analysis region check.
- ATT&CK
- T1204.002 Malicious FileT1562.001 Disable or Modify ToolsT1555.003 Credentials from Web BrowsersT1555.004 Credentials from Password StoresT1027 Obfuscated Files or Information
- Threat actors
- Unknown
- Malware
- RevStealer
- AI models
- Claude Opus 5
From the original article
3 min read at helpnetsecurity.com
A malicious GitHub repository impersonating Anthropic and claiming to offer free access to “Claude Opus 5” is delivering RevStealer, Windows information-stealing malware that targets passwords, cryptocurrency wallet data and login credentials, according to Morphisec.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.