Fake Claude App 101MB Attempts to Steal Cryptocurrency Wallets

A campaign to steal cryptocurrency wallets and account information through fake desktop installation files has been confirmed alongside the release of Anthropic's new Claude model. This is a case where external distributions, not vulnerabilities in the official Claude app, deceive users. Anthropic unveiled Claude Pable 5.1 and Claude Mythos 5.1 on September 1, with Pable 5.1 being a publicly available model and Mythos 5.1 limited to a trusted access program. Security firm Morphisec discovered the Windows information-stealing malware RevStealer in a GitHub distribution titled 'Claude Opus 5 Free Desktop.' This malware targets browser data, credentials, password manager files, and cryptocurrency wallet files. The fake distribution is circulated as a 'ClaudeOpus5-desktop.zip' file, approximately 101MB in size, and when executed, it does not display a window, with a 64-bit Electron app acting as a loader. RevStealer targets over 50 cryptocurrency wallets and around 10 password managers, with attackers using a bypass route through Polygon smart contracts. This malware encrypts data in memory and sends it to a server, and executing installation files from unofficial download paths may expose exchange account and personal wallet credentials. This case illustrates how AI model names and the phrase 'free access' can be used as security risks.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.