RevStealer spread via fake free Claude Opus 5 desktop build on GitHub
Morphisec says a repo posing as a free Anthropic model delivers a Windows infostealer that keeps a spare command server address in a Polygon smart contract, so taking the primary host down does not end operator control.
The Watch · Security desk
What happened
- Morphisec reported Monday that a Windows infostealer it calls RevStealer is being distributed from a GitHub repository advertising a free version of Anthropic's Claude Opus 5 model.
- The analyzed sample came from the repository claude5opus/Claude-Opus-5-Free-Desktop, where a ZIP archive runs an executable that starts an invisible Electron application acting as the loader.
- The stealer collects browser data and extensions, Windows Credential Manager entries, third-party password manager artifacts, crypto wallets, VPN and remote-access credentials, gaming profiles, messaging apps and documents.
- Rather than building an archive on disk, it streams collected data to the attacker's server as each item becomes available in memory.
- Morphisec found the sample carried a single VirusTotal detection and a community score of -54 at the time of analysis.
Why it matters
- What it limits constraint Response playbooks that end at server seizure and domain suspension do not finish this job, because the operator can repoint surviving infections through contract state that no host or registrar can revoke.
- Who's exposed exposure A home or contractor machine that installed a free model build becomes an authenticated route inward, since remote-access and VPN credentials sit in the same haul as the gaming logins.
- Who has to decide decision Anyone relying on antivirus verdicts to gate what employees install has to pick a different control, because the sample was effectively unflagged while it was working.
- What it sets up precedent Repos impersonating frontier model releases now belong on the same watchlist as cracked-software and cheat sites, which turns AI product naming into a brand-abuse monitoring cost for the vendors.
The loader's gating logic tells you who it expects to meet. It requires at least 2 GiB of physical memory, at least two logical CPU cores and at least one graphics adapter matching a hardcoded vendor list [3]. It also compares hostname and username against a blocklist of 14 keywords [4]. Morphisec published eight of them: johnson, miller, bruno, george, malware, maltest, currentuser and sandbox [4]. Six are unpublished [21], which matters if your analysis hosts follow a naming convention someone else has already guessed.
Nothing in the chain stops when a step fails; the loader just keeps moving. It tries to exclude AppData from Defender scanning without elevating, then decrypts and writes the payload there whether the exclusion succeeded or not [5]. It then tries to delete its own executable and staging directory and ignores errors, so those artifacts can survive for responders to find [6].
The payload repeats the anti-analysis work with a weighted score built from available memory, CPU configuration, process count, graphics hardware and uptime, alongside checks for debuggers, network analysis tools, process monitors and virtualization [13]. Some builds display a 6-character CAPTCHA and terminate on a wrong answer or a closed window [14]. It also terminates when the UI language, system language or keyboard layout matches any of ten languages, Russian, Ukrainian and Belarusian among them [15][22]. Windows APIs are resolved by walking the Process Environment Block and hashing export names rather than through an import table [16], strings and configuration stay encrypted until use [17], and 14 operations go through indirect syscall wrappers [18]. First contact with the C2 carries a 17-field fingerprint plus installed software, running processes, environment variables, clipboard contents and a desktop screenshot [19].
Then the fallback. Retrieval is an eth_call against a Polygon contract [10], so the address the operator wants used next sits in contract state rather than in the shipped binary, and it can be repointed without a new build [23]. Seize the primary host and surviving infections read where to go instead. What remains to filter is outbound traffic to public Polygon JSON-RPC endpoints [23].
Impact evidence is thin and should be read that way. One forum poster reported Microsoft and Electronic Arts accounts compromised within hours of installing the malware [12], a single account of the incident that has not been independently verified. The engineering is the documented part. "What makes it worth studying is how thoroughly it is engineered around the assumption that someone is watching," Morphisec researcher Shmuel Uzan wrote [20].
What to watch
- Whether GitHub removes claude5opus/Claude-Opus-5-Free-Desktop and whether clones appear under the same naming pattern.
- Whether Morphisec publishes the Polygon contract address, which is what makes RPC egress filtering and on-chain monitoring possible for defenders.
- Whether other commodity stealers adopt the on-chain fallback pointer rather than hardcoded backup domains.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption32
- Hype gap+15
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Morphisec reported Monday that a new Windows infostealer dubbed RevStealer is being spread through a GitHub repository offering a fake free version of Anthropic's Claude Opus 5 model.
- [2]
RevStealer is distributed through GitHub repositories and game cheat websites; the main analyzed version came from the repository claude5opus/Claude-Opus-5-Free-Desktop, where installing ClaudeOpus5-desktop.zip and running the contained executable launches an invisible Electron application acting as a loader.
- [3]
The Electron loader performs anti-sandbox checks for at least 2 GiB of physical memory, at least two logical CPU cores, and at least one recognized graphics adapter based on a hardcoded vendor list.
- [4]
The loader checks hostnames and usernames against a blocklist of 14 keywords, of which the report names eight: johnson, miller, bruno, george, malware, maltest, currentuser and sandbox.
- [5]
If sandbox checks pass, the loader attempts to exclude the AppData directory from Microsoft Defender scanning without elevating privileges, then decrypts the embedded payload and writes it under AppData regardless of whether the exclusion succeeded.
- [6]
After launching the RevStealer payload in a hidden window, the loader attempts to delete its executable and staging directory but ignores failures, potentially leaving those artifacts behind.
- [7]
RevStealer targets browser data and extensions, Windows Credential Manager and third-party password managers, cryptocurrency wallets, VPN and remote-access credentials, gaming profiles, messaging applications and user documents.
- [8]
Stolen data is streamed to an attacker-controlled server as it becomes available in memory, without staging a large archive on disk.
- [9]
A fallback command-and-control address is stored on a smart contract on the Polygon blockchain, which Morphisec describes as providing added resilience and flexibility.
- [10]
If the main C2 server becomes unavailable, the malware sends Polygon JSON-RPC eth_call requests to a smart contract.
- [11]
At the time of Morphisec's analysis, RevStealer had one detection on VirusTotal and a community score of -54.
- [12]
One victim posted in a forum discussion that their Microsoft and Electronic Arts accounts were compromised within hours of installing the malware.
- [13]
The payload checks for debuggers, network-analysis programs, process-monitoring tools and virtualization software using a weighted scoring system considering available memory, CPU configuration, process count, graphics hardware and system uptime.
- [14]
In some builds the stealer displays a 6-character CAPTCHA and terminates if the window is exited or an incorrect response is provided.
- [15]
The malware terminates if the UI language, system language or active keyboard layout matches Russian, Ukrainian, Belarusian, Tajik, Armenian, Azeri, Kazakh, Kyrgyz, Turkmen or Uzbek.
- [16]
RevStealer conceals Windows API resolution by walking the Process Environment Block at runtime and hashing exported function names rather than using a typical import table.
- [17]
The malware encrypts strings and configuration information and decrypts them only at the time of use.
- [18]
The malware uses indirect syscall wrappers for 14 operations to avoid exported entry points where monitoring hooks may trigger.
- [19]
After establishing contact with its C2 server, RevStealer sends a 17-field system fingerprint along with a snapshot of installed software, running processes, environment variables, clipboard contents and a desktop screenshot.
- [20]
Morphisec security researcher Shmuel Uzan wrote that RevStealer is not novel in what it steals, and that what makes it worth studying is how thoroughly it is engineered around the assumption that someone is watching.
- [21]
Six of the loader's 14 hostname and username blocklist keywords were not published in the report.
- [22]
The language and keyboard-layout kill switch covers ten language settings.
- [23]
Because the fallback C2 address is held in Polygon contract state and fetched by eth_call rather than compiled into the binary, taking down the primary server does not remove the operator's ability to redirect surviving infections, and outbound traffic to public Polygon JSON-RPC endpoints becomes the remaining interception point.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comFake Claude Opus 5 app delivers malware and wipes its own tracks
1 article · September 1, 2026
- scworld.comRevStealer malware spread through fake Claude Opus 5 download
1 article · September 1, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Infostealer MalwareFollow
- Blockchain-Resolved Command and ControlFollow
- GitHub as a malware distribution channelFollow
- AI brand impersonation luresFollow
- Anti-analysis and evasion engineeringFollow