CTI · corroborated · 2026-09-02

Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions

Full story & timeline

MITRE ATT&CK

• T1036 Masquerading Stealth
• T1204 User Execution Execution
• T1539 Steal Web Session Cookie Credential Access
• T1005 Data from Local System Collection

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: RevStealer Fake Claude Opus 5 - Suspicious Electron App Execution
id: e1c7f5a8-36d0-7b2e-f9c5-7a1d3e6b2c8f
status: experimental
description: >
    Detects execution patterns of the fake Claude Opus 5 application that
    deploys RevStealer, a Windows information stealer (gbhackers, 2026).
    The ~101 MB Electron executable performs anti-analysis checks including
    physical memory inspection, CPU core count, hostname/username queries,
    and debugger timing checks before decrypting an AES-256-CBC payload.
    The malware steals browser data, password managers, crypto wallets,
    VPN sessions, and Windows Credential Manager contents.
references:
    - https://gbhackers.com
    - https://cyberpress.org
author: Tia N. List
date: 2026/09/02
tags:
    - attack.t1036
    - attack.t1204
    - attack.t1539
logsource:
    category: process_creation
    product: windows
detection:
    selection_electron:
        Image|endswith:
            - '\electron.exe'
            - '\Claude Opus 5.exe'
            - '\claude.exe'
    selection_suspicious_parent:
        ParentImage|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - '\Desktop\'
    selection_suspicious_cmd:
        CommandLine|contains:
            - 'Claude'
            - 'Opus'
            - 'Anthropic'
    condition: selection_electron and (selection_suspicious_parent or selection_suspicious_cmd)
falsepositives:
    - Legitimate Electron applications installed by the user
level: medium

References

• https://gbhackers.com
• https://cyberpress.org