Cybersecurity Threat: Fake Claude Opus 5 App Delivers Malware and Erases Traces

Post Views: 8

A malicious GitHub repository mimicking Anthropic and offering purported access to “Claude Opus 5” has been identified as distributing RevStealer, a Windows-based information-stealing malware designed to extract sensitive data while evading detection.

Malicious Repository and RevStealer

The campaign leverages social engineering tactics to direct users to deceptive repositories and game-cheat-themed websites, according to Morphisec. The compromised repository, named Claude-Opus-5-Free-Desktop, contains a file that executes without displaying a visible window. Upon activation, the program performs initial checks on system memory, processor configuration, hostname, username, and graphics hardware against a blocklist. It then attempts to add the user’s AppData directory to Windows Defender’s exclusion list, decrypts an embedded file, and initiates the RevStealer payload in the background.

RevStealer’s Evasion Techniques

Once operational, RevStealer employs advanced techniques to remain undetected. It resolves Windows APIs without relying on a traditional import table, keeps its configuration encrypted until deployment, and uses indirect system calls to bypass user-mode hooks. Stolen data is transmitted directly to its command-and-control server without creating local archives, and the malware self-erases after execution.

Fallback Mechanism via Blockchain

The campaign also incorporates a fallback mechanism: if the primary server is unreachable, RevStealer retrieves an alternative address from a smart contract on the Polygon blockchain, enabling operators to shift infrastructure without modifying the malware itself.

Data Targets and Theft Methods

RevStealer’s targets include browser databases, saved credentials, extension storage, Windows Credential Manager entries, password manager files, cryptocurrency wallet applications, VPN and remote access credentials, messaging app data, game launcher accounts, OBS streaming profiles, clipboard content, screenshots, and user documents. A victim reported compromised Microsoft and EA accounts following interaction with the malicious file, as noted in a forum discussion cited in the report.

Evasion Strategies

RevStealer’s evasion strategies include ten distinct checks to identify virtual machines, sandboxes, or analysis tools. These assessments evaluate running processes, CPU and memory characteristics, graphics hardware, system identity, and uptime, generating a hidden score that determines whether the malware proceeds. If the score exceeds a threshold, the payload delays execution for several seconds before terminating. Additionally, systems configured with Russian, Ukrainian, or several Central Asian languages are immediately halted.

Fake Verification Window

A fake verification window with a randomized challenge code is also displayed, with incorrect input or closure triggering termination. For browsers utilizing App-Bound encryption, such as Chrome and Edge, RevStealer launches the browser under debugger control and sets a hardware breakpoint to capture the App-Bound key when it appears in memory.

Researcher Insights and Recommendations

After data collection, the malware receives a task list from its server, with confirmed actions including credential theft and data exfiltration. Researchers emphasize that attackers continuously adapt lures, packaging, and infrastructure to evade detection. A GitHub repository impersonating an AI vendor today may serve as a different threat vector tomorrow. Morphisec highlights that combating RevStealer requires disrupting its execution environment rather than relying on traditional detection methods.

The report includes indicators of compromise for affected organizations. Additional details about the malware’s behavior and evasion tactics are available through Morphisec’s analysis.