Fake Claude Desktop App Used to Spread Crypto-Stealing Malware

Cybersecurity researchers have identified a fake desktop application impersonating a popular AI assistant, used to distribute a Windows based malware strain known as RevStealer. The counterfeit program, marketed as a free version of a premium AI model, tricks users into downloading malicious software disguised as legitimate technology.

How the Malware Operates

RevStealer is built to quietly harvest sensitive data, including browser passwords, cookies, saved credentials, VPN and remote access settings, messaging records, screenshots and select documents. The malware also targets more than 50 different cryptocurrency wallets, making it a serious threat to digital asset holders.

Built to Avoid Detection

Before activating, the malware checks whether it is running on a genuine user device by examining system memory, processor details, hostname and graphics hardware. It also watches for delays typical of malware analysis tools. Only if the system appears authentic does it decrypt and execute its payload under a randomized file name.

The discovery follows a separate report on another crypto targeting malware framework capable of stealing wallet files and hijacking browser extensions.