Fake Claude App Spreads RevStealer Malware, Targets 50+ Crypto Wallets

A cybersecurity headline from September 1, 2026 is a useful gut-check for anyone who has ever searched "free Claude download": researchers at Morphisec disclosed that a fake desktop app calling itself "Claude Opus 5 Free Desktop" was distributing crypto-stealing malware named RevStealer. The malware targets more than 50 cryptocurrency wallets and 12 password managers, and it was built to leave almost no trace once it's done.

Anthropic didn't make this app. Nobody at Anthropic was hacked. This is impersonation — attackers riding the popularity of Claude to get a stealer onto your machine — and the same playbook works against any AI product people are eager to try for free. That makes it worth understanding in detail, not just skimming past.

TL;DR

How the fake Claude app spreads

Morphisec's writeup traces the "Claude Opus 5 Free Desktop" package to two distribution channels: GitHub repositories advertising it as a way to get free access to a paid Claude model, and video-game cheat websites that had already been serving the same RevStealer payload under unrelated branding before switching the lure to Claude. The download itself is a roughly 101-megabyte archive containing a 64-bit Electron application — a shape that mimics how legitimate desktop AI clients are usually packaged, which is part of what makes it convincing to a hurried downloader.

Notice what's not on that list: Anthropic's own site, the Apple App Store, Google Play, or the Microsoft Store. This tracks with how Anthropic's own agent-skill ecosystem gets attacked — supply-chain abuse targets the places with the least gatekeeping, not the vendor's official storefront. "Free access to a model that normally costs money" is the bait; an unofficial GitHub link or a game-cheat forum is the delivery mechanism. Neither one should be where you get an AI product from.

What RevStealer actually does once it runs

RevStealer is a multi-stage Windows infostealer, and its engineering choices are worth walking through because they explain why it's dangerous and why it's hard to catch in hindsight.

• Encrypted payload, in-app. The Electron shell stores its real payload AES-256-CBC-encrypted inside the application bundle, decrypting it only at runtime.
• Defender evasion. It attempts to add its own AppData folder to Microsoft Defender's exclusion list before doing anything else.
• Anti-analysis gating. It checks available memory (2GB minimum), CPU core count (2 minimum), graphics hardware, and hostname/username against a blocklist tuned to catch security-research sandboxes. It also measures timing around JavaScript debugger instructions — if execution pauses more than roughly 100 milliseconds, a sign a researcher is stepping through it, it erases its own encoded strings.
• VM and locale detection. It runs ten weighted anti-virtual-machine checks and disables itself on systems set to Russian, Ukrainian, or Central Asian locales — a pattern common among malware operators based in that region avoiding local law enforcement attention.
• The actual theft. Once it decides the environment is safe, it searches for credentials across more than 50 crypto wallet applications and 12 password managers, plus browser-stored passwords and cookies, VPN and remote-access configs, clipboard contents, messaging-app data, and selected documents and screenshots.
• No persistence. Unlike malware built to stick around, RevStealer doesn't create scheduled tasks or startup entries. Researcher Shmuel Uzan, quoted in coverage of the Morphisec report, put it this way: "Every stage of it is engineered around the assumption that something is watching." It grabs what it can in one burst, phones home, and removes itself.
• Blockchain-based fallback C2. If its primary command-and-control server goes down, RevStealer can pull an alternate address from a smart contract deployed on the Polygon blockchain — a resilience trick that's shown up in other 2026-era stealers because on-chain data is far harder to take down than a domain or IP.

That combination — encrypted payload, sandbox evasion, self-deletion, and blockchain-backed C2 — is a genuinely well-engineered piece of crimeware, not a crude script. It's a reminder that the bar for "convincing fake AI app" has moved well past a poorly-made phishing page.

About that "50 wallets" number

Worth being precise here, because headlines compress this in a way that can mislead. The 50+ crypto wallets figure describes RevStealer's targeting scope — the number of distinct wallet applications the malware's code knows how to locate and extract credentials from — not a confirmed count of victims or stolen funds. It comes from Morphisec's technical teardown of the malware itself, published August 31, 2026, not from Anthropic, a law-enforcement disclosure, or a tally of reported thefts. No public victim count or dollar loss figure has been released as of this writing. That distinction matters: it tells you how broad the capability is, not how many people have actually lost money to it yet — and given that RevStealer leaves no persistence trail, an accurate victim count may simply never surface.

Red flags: how to tell a real AI app from an impersonator

This incident is a specific instance of a general pattern that also shows up in Claude Cowork's sandbox-escape history and in supply-chain attacks against agent skills: attackers exploit trust in a brand name to get code onto your machine. The checklist is the same regardless of which AI product's name gets borrowed next.

If you're deciding whether to trust a browser extension claiming Claude integration, the same logic applies: check the publisher, read the requested permissions literally, and compare against how Claude Code's own security tooling flags risk rather than trusting a name in a listing.

What to do if you think you installed it

RevStealer's self-deletion means you may not find an active process to kill — treat "am I still infected right now" as the wrong question and act on "what did it already see."

1. Disconnect from the network before doing anything else, to cut off any live exfiltration if the malware is still mid-run.
2. Revoke wallet approvals and allowances. If you use MetaMask or a similar wallet, go to its connected-sites/approvals screen and revoke every dApp connection you don't recognize — a stolen seed phrase is dangerous, but an unrevoked spending approval can be worse because it doesn't require the attacker to move funds through your wallet at all.
3. Move funds to a new wallet with a freshly generated seed phrase, generated on a device you're confident is clean — not the one that ran the fake app.
4. Rotate every password stored in a password manager that was on the infected machine, starting with financial accounts, email, and any account tied to your crypto exchanges. Do this from a different, trusted device.
5. Check for browser session hijacking, not just password theft — RevStealer also grabs cookies, which can let an attacker skip your password entirely on services that don't force re-authentication.
6. Reinstall the OS on the affected machine if you can't be certain no persistence mechanism was added by a companion payload — Morphisec's analysis covers RevStealer itself, not every campaign that might bundle it with something else.
7. Report it. File a report with your national cybercrime reporting body and, if crypto was involved, with the exchange or wallet provider — some maintain stolen-fund tracking that can flag addresses linked to known stealer campaigns.

The pattern here — urgency ("free access!"), an unofficial channel, and a request that skips normal verification — is the same one behind deepfake video-call fraud and other social-engineering losses in 2026. The technical sophistication changes; the psychological lever attackers pull rarely does.

The bigger pattern: brand impersonation as an attack vector

This isn't the first time Claude's name has been the vehicle for something Anthropic didn't build or authorize. Anthropic has separately had to litigate against a trademark dispute with a cybersecurity vendor over its own branding, and researchers have repeatedly found that Claude's memory and browsing features can be tricked into leaking data through channels a user never directly interacts with. The common thread across all of these: as an AI brand becomes something people actively search for and trust, it becomes worth impersonating — whether the goal is trademark confusion, data exfiltration through a legitimate product's own features, or, as here, tricking someone into running a stealer with the brand's name on the icon.

For builders specifically, this is also a supply-chain lesson that maps directly onto why agent skills need verification pipelines before they reach a marketplace: a familiar name is not the same as a verified source, and the gap between the two is exactly where malware like RevStealer lives.

Related reading

• Why agent skills are a security risk — and how explainx.ai verifies every skill
• Is Claude Cowork Safe? Complete Security Analysis
• Claude Cowork SharedRoot: Sandbox Escape to the Host Mac
• Claude Memory Heist: web_fetch Exfiltrated PII From Claude.ai Memory
• Deepfake Fraud: Inside the $25.6 Million Video Call Scam
• Claude Code Security-Guidance Plugin
• BitGo's CEO Put 100 BTC in a Wallet and Dared Claude to Hack It
• Abnormal AI vs Anthropic: Trademark Lawsuit and Response

Official channels: download Claude only from claude.ai or via the official app listings on the Apple App Store and Google Play under Anthropic's developer account.

Details on RevStealer's technical behavior and distribution are based on Morphisec's August 31, 2026 disclosure as reported by crypto.news and CoinTelegraph. Malware campaigns evolve quickly — verify current distribution vectors and detection signatures against your antivirus vendor's latest advisories before acting on specifics here.