Loading today’s stories
Security1 distinct publisher2 min readPublished
Morphisec says a repo posing as a free Anthropic model delivers a Windows infostealer that keeps a spare command server address in a Polygon smart contract, so taking the primary host down does not end operator control.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
security
Aeternum puts botnet C2 on Polygon, and leaves defenders no domain to seize1 distinct publisher
build
Claude Code's new default is a confession: the approval prompt was never a control1 distinct publisher
invest
The fake Qwen repo undershot its advertised weights by a factor of 34,0001 distinct publisher
build
Grok 4.6 lands in Copilot two days after launch, and the model picker becomes a procurement problem1 distinct publisher
The loader's gating logic tells you who it expects to meet. It requires at least 2 GiB of physical memory, at least two logical CPU cores and at least one graphics adapter matching a hardcoded vendor list [4]. It also compares hostname and username against a blocklist of 14 keywords [5]. Morphisec published eight of them: johnson, miller, bruno, george, malware, maltest, currentuser and sandbox [5]. Six are unpublished [1], which matters if your analysis hosts follow a naming convention someone else has already guessed.
Nothing in the chain stops when a step fails; the loader just keeps moving. It tries to exclude AppData from Defender scanning without elevating, then decrypts and writes the payload there whether the exclusion succeeded or not [6]. It then tries to delete its own executable and staging directory and ignores errors, so those artifacts can survive for responders to find [7].
The payload repeats the anti-analysis work with a weighted score built from available memory, CPU configuration, process count, graphics hardware and uptime, alongside checks for debuggers, network analysis tools, process monitors and virtualization [14]. Some builds display a 6-character CAPTCHA and terminate on a wrong answer or a closed window [15]. It also terminates when the UI language, system language or keyboard layout matches any of ten languages, Russian, Ukrainian and Belarusian among them [16][2]. Windows APIs are resolved by walking the Process Environment Block and hashing export names rather than through an import table [17], strings and configuration stay encrypted until use [18], and 14 operations go through indirect syscall wrappers [19]. First contact with the C2 carries a 17-field fingerprint plus installed software, running processes, environment variables, clipboard contents and a desktop screenshot [20].
Then the fallback. Retrieval is an eth_call against a Polygon contract [11], so the address the operator wants used next sits in contract state rather than in the shipped binary, and it can be repointed without a new build [3]. Seize the primary host and surviving infections read where to go instead. What remains to filter is outbound traffic to public Polygon JSON-RPC endpoints [3].
Impact evidence is thin and should be read that way. One forum poster reported Microsoft and Electronic Arts accounts compromised within hours of installing the malware [13], a single account of the incident that has not been independently verified. The engineering is the documented part. "What makes it worth studying is how thoroughly it is engineered around the assumption that someone is watching," Morphisec researcher Shmuel Uzan wrote [21].
Ranked by verification strength, evidence, and original report placement.
Morphisec reported Monday that a new Windows infostealer dubbed RevStealer is being spread through a GitHub repository offering a fake free version of Anthropic's Claude Opus 5 model.
RevStealer is distributed through GitHub repositories and game cheat websites; the main analyzed version came from the repository claude5opus/Claude-Opus-5-Free-Desktop, where installing ClaudeOpus5-desktop.zip and running the contained executable launches an invisible Electron application acting as a loader.
The Electron loader performs anti-sandbox checks for at least 2 GiB of physical memory, at least two logical CPU cores, and at least one recognized graphics adapter based on a hardcoded vendor list.
The loader checks hostnames and usernames against a blocklist of 14 keywords, of which the report names eight: johnson, miller, bruno, george, malware, maltest, currentuser and sandbox.
If sandbox checks pass, the loader attempts to exclude the AppData directory from Microsoft Defender scanning without elevating privileges, then decrypts the embedded payload and writes it under AppData regardless of whether the exclusion succeeded.
After launching the RevStealer payload in a hidden window, the loader attempts to delete its executable and staging directory but ignores failures, potentially leaving those artifacts behind.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 1, 2026
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Precise teardown, single origin
The detail is the kind that is hard to fabricate — hardware breakpoints placed on a Chrome-derived process to lift the App-Bound key, 14 indirect syscall wrappers, a 17-field check-in — and it all arrives from one place: Morphisec's report, relayed by SC Media. No hash, no repository archive, no second lab's read, and six of the 14 blocklist keywords are withheld, so a reader cannot verify a single number independently.
One repository, one self-reported victim
In-the-wild footprint amounts to a named GitHub repository, an unspecified set of game cheat sites, a sample sitting on VirusTotal with one detection, and a single anonymous forum poster describing Microsoft and EA account takeovers. That is enough to say the campaign is real and running; it is nowhere near enough to say how far it has spread, and the reporting offers no infection estimate at all.
The lure travels further than the numbers
A free Claude Opus 5 build and a command server hidden in a Polygon contract are the two phrases that will carry this story, and both sit on a base of one repository and one forum post. What keeps the gap small is the vendor's own opening line: Uzan says the haul — browser databases, wallet files, session tokens — has been standard for years, and SC Media leaves that framing intact rather than reaching for novelty.
Endpoint vendor documenting an endpoint blind spot
Morphisec sells endpoint defense, and the spine of its report is that this stealer stays mostly invisible to endpoint security products, with one detection across VirusTotal to prove it. The technical work may be entirely sound and still be shaped by which findings are worth publishing. SC Media labels it as vendor research and quotes the researcher directly, but does not test the sample or seek another lab's view.
Trust the mechanics, not the scale
Two different reliabilities are bundled together here. How the thing works is described at a granularity peers will be able to confirm or correct as soon as samples circulate. How much it matters rests on a single VirusTotal record and one unnamed forum poster — and on this reporting alone, that half of the story should be treated as provisional.