RevStealer Malware Distributed via Fake Claude Opus 5 App

• •RevStealer targets sensitive data like passwords and cryptocurrency wallets.
• •It is distributed through a fake Claude Opus 5 app on GitHub.
• •The malware employs advanced evasion techniques to avoid detection.

RevStealer, a new Windows infostealer, is being distributed through a malicious GitHub repository masquerading as a free version of Anthropic's Claude Opus 5. This malware targets sensitive data such as passwords, cryptocurrency wallets, and browser credentials. It employs advanced evasion techniques, including anti-sandbox checks and encrypted data exfiltration, making it difficult for security systems to detect. The malware is delivered via a trojanized Electron application that runs invisibly, performing checks on system resources before executing its payload. Victims have reported compromised accounts, including Microsoft and Electronic Arts, shortly after installation. The malware's command-and-control infrastructure can adapt using a fallback address stored on the Polygon blockchain, enhancing its resilience. At the time of analysis, RevStealer had minimal detection on antivirus platforms, indicating its stealthy nature. Security experts recommend avoiding unofficial downloads of software claiming to be free versions of paid applications.