Security

THORWallet

Read

<p><strong>A fake Claude app is spreading malware called RevStealer, and researchers say it targets more than 50 crypto wallets. The trap poses as a free desktop version of Anthropic's AI assistant, but it quietly steals wallet data from anyone who installs it.</strong></p>
<p>Security researchers at Morphisec Threat Labs uncovered the campaign. They found that RevStealer spread through a fake "Claude Opus 5 Free Desktop" project hosted on GitHub, <a href="https://www.morphisec.com/blog/revstealer-silence-is-its-greatest-weapon/" rel="noopener noreferrer nofollow">impersonating Anthropic</a>, the company behind Claude. For related coverage, see <a href="https://www.coinlineup.com/ireland-excludes-crypto-tax-friendly-investment-accounts/" rel="noopener noreferrer nofollow">Ireland Excludes Crypto From New Tax-Friendly Accounts</a>.</p>
<p>This matters because the attack preys on trust. People searching for popular AI tools may download the fake app without a second thought, then hand attackers the keys to their crypto. For related coverage, see <a href="https://www.coinlineup.com/arizona-crypto-atm-law-scam-victims-recover-171332/" rel="noopener noreferrer nofollow">Arizona Crypto ATM Law Helped 35 Scam Victims Recover $171,332</a>.</p>
<h2 id="how-the-fake-claude-app-delivers-revstealer">How the Fake Claude App Delivers RevStealer</h2>
<p>The lure is simple. Victims think they are getting a free desktop version of Claude, a well-known AI chatbot. Instead, they download a booby-trapped file. For related coverage, see <a href="https://www.coinlineup.com/thorwallet-self-custodial-crypto-card-172-countries/" rel="noopener noreferrer nofollow">THORWallet Launches Self-Custodial Crypto Card in 172 Countries</a>.</p>
<p>Morphisec said the download was a roughly 101 MB archive that launched an Electron application with no visible window. An Electron app is software built with web technology; here, it ran silently with no interface, so the victim saw nothing happen.</p>
<p>Before unpacking its true payload, the malware ran a series of checks. It inspected memory, CPU cores, graphics hardware, and blocklisted usernames or hostnames, <a href="https://cyberinsider.com/new-revstealer-malware-spreads-as-fake-claude-opus-5-desktop-app/" rel="noopener noreferrer nofollow">according to CyberInsider</a>. These checks help malware avoid running inside a researcher's test machine.</p>
<p>The stealth worked. Help Net Security reported that the malicious sample was flagged by only <a href="https://www.helpnetsecurity.com/2026/09/01/revstealer-malware-claude-opus-5-github/" rel="noopener noreferrer nofollow">1 of 66 antivirus engines</a> in the research screenshots. That means nearly every scanner missed it.</p>
<p>This campaign follows a familiar pattern. Attackers recently hid the Lumma Stealer inside <a href="https://www.coinlineup.com/pirated-the-odyssey-downloads-lumma-stealer-crypto-wallets/" rel="noopener noreferrer nofollow">pirated movie downloads to target crypto wallets</a>, showing how popular content becomes bait.</p>
<h2 id="why-crypto-wallet-users-are-the-primary-target">Why Crypto Wallet Users Are the Primary Target</h2>
<p>RevStealer is built to rob crypto holders. Morphisec said its confirmed collection list covered <a href="https://www.scworld.com/news/revstealer-malware-spread-through-fake-claude-opus-5-download" rel="noopener noreferrer nofollow">more than fifty cryptocurrency wallets</a>.</p>
<figure style="margin:0;padding:18px;border:1px solid #d9d9d9;border-radius:14px;background:#f8f7f3">
 <div style="font-family:Arial,sans-serif;font-size:12px;line-height:1.4;letter-spacing:0.08em;text-transform:uppercase;color:#666666;margin-bottom:8px">
  Confirmed wallet targets
 </div>
 <div style="font-family:Georgia,serif;font-size:44px;line-height:1;font-weight:700;color:#111111;margin-bottom:10px">
  50+
 </div>
 <figcaption style="font-family:Arial,sans-serif;font-size:14px;line-height:1.5;color:#333333">
  RevStealer’s confirmed collection list covered more than fifty cryptocurrency wallets, underscoring the campaign’s direct theft focus.
 </figcaption>
</figure>
<p>Wallet-targeting malware is especially dangerous. If it grabs your wallet's login data or secret keys, an attacker can drain your funds. Unlike a bank, crypto has no fraud department to reverse the theft.</p>
<p>This is a direct threat to everyday holders, not just big traders. Anyone using self-custody, meaning you hold your own keys instead of an exchange, faces real exposure here.</p>
<p>The malware also had a clever backup plan. RevStealer could read a fallback command-and-control address from a Polygon smart contract if its main server went down. Smart contracts are automated programs on a blockchain, and using one made the malware harder to shut off.</p>
<p>The timing raises the stakes. Bitcoin's market value sat near 1.55 trillion dollars in recent market data, showing how much wealth now sits in the ecosystem these thieves target.</p>
<figure style="margin:0;padding:18px;border:1px solid #d9d9d9;border-radius:14px;background:#f3f7f8">
 <div style="font-family:Arial,sans-serif;font-size:12px;line-height:1.4;letter-spacing:0.08em;text-transform:uppercase;color:#5c6b73;margin-bottom:8px">
  Bitcoin market-cap backdrop
 </div>
 <div style="font-family:Georgia,serif;font-size:44px;line-height:1;font-weight:700;color:#102a43;margin-bottom:10px"><a rel="noopener noreferrer nofollow" href="https://www.coingecko.com/en/coins/bitcoin" style="color:#102a43;text-decoration:none">$1.55T</a>
 </div>
 <figcaption style="font-family:Arial,sans-serif;font-size:14px;line-height:1.5;color:#334e68">
  The brief’s bitcoin snapshot places the broader crypto market near a 1.55 trillion dollar bellwether valuation while wallet-focused malware is active.
 </figcaption>
</figure>
<p>Market mood is upbeat, which can lower people's guard. The crypto <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> reads 69, signaling "Greed" among investors.</p>
<p>Morphisec researcher Shmuel Uzan described just how carefully the malware hides. He said "every stage of it is engineered around the assumption that something is watching."</p>
<h2 id="what-users-should-watch-for-after-the-revstealer-alert">What Users Should Watch for After the RevStealer Alert</h2>
<p>The clearest lesson is to avoid unofficial download sources. A GitHub project or random link promising a free AI app is not the same as an official release from the company.</p>
<p>Always verify software authenticity before installing. Check the developer's official website first, and be suspicious of any "desktop" version of a tool that normally runs in your browser.</p>
<p>Crypto wallet users should review their device and account security now. If you installed anything odd recently, consider moving funds to a fresh wallet and scanning your device.</p>
<p>Fake software lures keep spreading fast. Researchers recently flagged <a href="https://www.coinlineup.com/socket-found-40-malicious-firefox-add-ons-targeting-crypto-users/" rel="noopener noreferrer nofollow">40 malicious Firefox add-ons aimed at crypto users</a>, another reminder to install only what you can verify.</p>
<p>For anyone new to crypto, the safest habit is caution. Slow down before downloading, double-check the source, and treat your wallet keys like the password to your entire savings account.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.coinlineup.com/?p=37874" rel="noopener noreferrer nofollow">Read original article on coinlineup.com</a>

Fake Claude App Spreads RevStealer Malware, Targeting 50+ Crypto Wallets

Table of Contents

Coinlineup.com

Other articles published on Sep 1, 2026

Join our free newsletter for daily crypto updates!