Fake Claude Opus desktop app distributes RevStealer malware targeting 50+ crypto wallets on Windows

Security reporting says a fraudulent desktop application impersonating “Claude Opus 5 Free Desktop” is distributing the RevStealer malware on Windows systems ^[1].

The reports state the malware is designed to compromise more than 50 cryptocurrency wallets and 12 credential management tools, and that stolen information is transmitted to remote infrastructure before the malware self-destructs ^[1].

One report adds that a fallback command server address is embedded within a Polygon blockchain smart contract ^[1].

A separate source similarly reports that a malicious “Claude” AI desktop app delivers RevStealer to hijack cryptocurrency wallets ^[2].

Another source, described as lower-authority, claims a fake Claude desktop app was used to deliver crypto-stealing malware ^[3].

A further low-authority report describes an incident involving a developer who clicked a malicious link disguised as Anthropic’s Claude AI desktop application and says the developer reportedly avoided malware installation, based on other outlets’ accounts ^[4].