Elastic finds four REVSTEALER companion modules that persist after the stealer deletes itself, including one that mines crypto.
A GitHub repo promising free Claude Opus 5 is quietly installing the RevStealer infostealer, according to Morphisec.