Reported by 2 outlets
Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions
gbhackers.com · 42d ago · September 1st, 2026
Threat actors are exploiting demand for generative AI tools to distribute RevStealer, a Windows-focused information stealer hidden inside a trojanized Electron application that impersonates a free desktop version of Anthropic’s Claude Opus 5. Instead a stealthy credential theft tool engineered to evade sandboxes, endpoint monitoring, and post-infection investigation. The primary lure, branded “Claude Opus 5 […] The post Fake Claude Opus 5 App Deploys RevStealer to Steal Passwords, Crypto Wallets and Sessions appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Fake Claude Opus 5 App Caught Stealing Passwords and Crypto Wallets
cyberpress.org · 42d ago · September 1st, 2026
Cybersecurity researchers have uncovered a Windows information-stealing malware campaign disguised as a legitimate AI application. The campaign uses a fake “Claude Opus 5 Free Desktop” project hosted through GitHub repositories and promoted on game-cheat-themed websites. The lure attempts to exploit growing interest in AI tools by promising free access to a paid AI model. Once executed, RevStealer can collect sensitive information from browsers, password managers, cryptocurrency wallets, VPN applications and other software. It also targets session cookies, Windows Credential Manager data, clipboard contents, screenshots and selected documents. Fake Claude App Steals Credentials The attack begins with an approximately 101 MB archive containing a 64-bit Electron executable . The application does not display a normal user interface. Instead, it performs several checks designed to identify security-analysis environments. The loader checks available physical memory, CPU cores, hostname, username and graphics hardware. It also uses a debugger timing check. If execution appears to be taking place under analysis, the malware can destroy its encoded string information and stop. After these checks succeed, the loader decrypts an AES-256-CBC encrypted native payload stored inside the application resources. It writes the payload into a randomly