Windows users chasing a free copy of Claude Opus 5 on GitHub are winding up with RevStealer, an infostealer aimed at passwords and crypto wallets. The campaign, detailed by Morphisec, leans on a repository that impersonates Anthropic.
Named Claude-Opus-5-Free-Desktop, the repo dangles a 101 MB file, ClaudeOpus5-desktop.zip, backed by screenshots and model comparison charts. Nothing opens when the file runs. The malware first sizes up the machine’s memory, CPU count, hostname, username, and graphics hardware against a blocklist, then adds the AppData folder to Defender’s exclusions, decrypts a bundled payload, and launches RevStealer in the background.
The stealer resolves Windows APIs without a normal import table, keeps its configuration encrypted until use, calls the kernel through indirect system calls to slip past user-mode hooks, streams stolen data straight to its server, and deletes itself afterward. If the primary command server is down, it reads a fallback address from a smart contract on the Polygon blockchain, letting operators rotate infrastructure without rebuilding the malware.
RevStealer targets browser databases, password managers, more than fifty cryptocurrency wallet applications, VPN credentials, messaging app data, and selected documents. Ten separate checks detect virtual machines and sandboxes, and the malware shuts down outright on systems set to Russian, Ukrainian, or several Central Asian languages. At check time, only one of 66 antivirus engines flagged the file.
Defenders should treat free AI-branded downloads as a lure class and focus on blocking execution techniques rather than chasing hashes and packaging variants.
