Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5.
Instead a stealthy credential theft tool engineered to evade sandboxes, endpoint monitoring, and post-infection investigation.
The primary lure, branded “Claude Opus 5 Free Desktop,” is distributed as a roughly 101 MB archive.
Its included executable is a 64-bit Electron application that presents no meaningful user interface and launches no visible application window.
Rather than delivering a working AI client, the Electron wrapper serves as a loader for an AES-256-CBC-encrypted native malware payload concealed in its resources.
The campaign underscores how AI branding has become a high-value social-engineering surface.
Attackers are increasingly exploiting the desire for free or unrestricted access to premium AI models, particularly where users may be willing to bypass official vendor channels, download GitHub projects, or turn off security controls to run unofficial tools.
RevStealer’s collection capabilities are familiar for an infostealer. It targets browser databases, encryption keys, stored credentials, cookies, extension data, cryptocurrency wallets, password managers, VPN configurations, Windows Credential Manager entries and remote-access artifacts.
It also collects data from messaging applications, game launchers, OBS streaming profiles, the clipboard, screenshots and selected files.
Its operational design, however, is built around avoiding observation before theft begins.
Before decrypting its payload, the Electron loader evaluates the host environment.
It checks for at least 2 GB of physical memory, two logical CPU cores, permitted hostname and username values, and a recognized graphics adapter.
These checks help the malware reject virtual machines, automated analysis environments and lightly provisioned sandboxes.
A JavaScript timing check adds another layer. The loader measures execution around a debugger statement and destroys its encoded string table if execution pauses for more than about 100 milliseconds.
This frustrates manual reverse engineering and debugger-driven analysis.
Once those checks pass, the loader decrypts the embedded payload, writes it to a randomly named folder under AppData, launches it as a hidden detached process and attempts to delete its staging file.
It also attempts to add the user’s AppData directory to Microsoft Defender exclusions, potentially reducing local scanning coverage for the malware’s temporary files.
The campaign, observed by Morphisec Threat Labs, uses GitHub repositories and game-cheat-themed websites to entice victims into downloading what appears to be a legitimate AI application.
Fake Claude Opus 5 App
The native RevStealer payload applies further anti-analysis controls, including a weighted anti-VM scoring system, CAPTCHA-based execution gating and regional exclusions.
Systems configured for Russian, Ukrainian and several Central Asian language settings are terminated, a pattern often used by operators seeking to avoid infecting systems in regions where they may face greater operational risk.
The malware resolves Windows APIs dynamically rather than exposing a conventional import table.
It also uses 14 indirect syscall wrappers to reach the Windows kernel without calling the exported user-mode functions where endpoint detection and response products commonly place hooks.
RevStealer registers a vectored exception handler to keep the theft routine running if individual collectors fail.
It decrypts C2 configuration only when needed, streams collected data in encrypted typed records, and deletes itself after completing its task.
The malware does not establish persistence through Run keys, scheduled tasks or startup entries.
That short execution window is central to the threat. By the time a security product flags suspicious behavior, browser sessions, passwords and wallet data may already have been exfiltrated.
RevStealer also includes a resilient command-and-control mechanism. If its primary C2 server is unavailable, it retrieves a fallback server address from a smart contract on the Polygon blockchain.
This lets operators rotate infrastructure without rebuilding and redistributing the malware, complicating conventional takedown and domain-seizure efforts.
The technique reflects a broader trend in malware operations: blockchain infrastructure can provide a durable, decentralized layer for publishing configuration data, even where the actual payload delivery and exfiltration systems remain centralized.
For defenders, the campaign reinforces that users should download AI software only from verified vendor domains and official distribution channels.
Organizations should monitor unusual Electron application launches, suspicious child processes created from AppData, unauthorized Defender exclusion changes, browser-data access, wallet-extension access and outbound connections.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
