Security Fake Claude Desktop App Spreads RevStealer Malware Targeting 50+ Crypto Wallets
In brief: Security firm Morphisec has disclosed that a fake desktop app impersonating Anthropic’s “Claude Opus 5 Free Desktop” is spreading RevStealer, Windows malware that can steal credentials from more than 50 crypto wallets and browsers.
Key points
- Attack vector: Bad actors posted a lookalike “free Claude” project on GitHub posing as Anthropic, tricking users into installing a malicious desktop app.
- Malware: RevStealer is a Windows information stealer targeting 50+ crypto wallets, plus browser passwords, cookies, password manager records, VPN settings, messaging data and selected documents.
- Stealth: The malware cleans up its own traces after executing the payload, making detection harder for average users.
- Why it matters: The AI-tool hype makes “free Claude download” searches a prime lure, with crypto holders facing the highest risk.
Observations
- Only download software from official websites or official app stores — AI tools included. Legitimate projects do not need “cracked free versions” as bait.
- Verify the source: the download page domain, publisher identity, code-signing certificate and file hash are key checks before installing anything.
- For crypto security, never enter seed phrases or private keys into non-official pages or desktop programs; move assets immediately if anything looks wrong. Exchange apps should only come from the official Binance download guide or the official OKX download guide, and you can verify every step with our official site verification & anti-phishing checklist.
FAQ
How do I spot a fake Claude app? Official Claude is distributed only through Anthropic’s website and legitimate app stores. Any installer offered as “free/cracked” is a red flag; check the domain, publisher and signature before installing.
I installed a suspicious app and my wallet may be compromised — what now? Disconnect from the network, move funds from a clean device (start with large balances), run a security scan, change all related passwords, and consider freezing affected accounts.
Risk warning
This article is based on a security vendor’s report and public coverage (2026-09-01). Malware variants evolve quickly, so defer to official security advisories. Never share seed phrases, private keys or passwords through unofficial channels.
Related Coins
Related News
Security Liquid Network Drains ~$320M in BTC; Self-Described White Hats Return Most
Roughly 4,000 BTC (~$320 million) was moved out of the Liquid Network's federation wallet by self-described white hats, halting the Bitcoin sidechain; about 3,400 BTC have been returned after a fix. Event recap, not investment advice. (Source: theblock.co, 2026-09-08)
DeFi Cronos Halts After Tectonic Exploit: What DeFi Users Should Know
The Cronos network paused after an apparent exploit of the Tectonic lending protocol, with losses estimated at around $75 million; here is what users should watch. (Source: theblock.co, 2026-09-01)
入门 Whale shifts $105M from Bitcoin to Ethereum in five days
A single wallet sold 1601 BTC and bought over 53,000 ETH between October 11–15, 2026 — a confirmed on-chain spot transfer valued at ~$105M using CoinGecko…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.