A sophisticated cyber threat known as the RevStealer crypto malware is compromising Windows operating systems by masquerading as a desktop application for Anthropic’s Claude artificial intelligence client. Cybersecurity firm Morphisec revealed that the malicious software successfully targets more than 50 different cryptocurrency wallets and 12 major password managers. The attack exploits the massive public demand for paid AI platforms, tricking victims into running an unverified 101-megabyte desktop application.
This campaign leverages the rapid growth of artificial intelligence to bait unsuspecting cryptocurrency investors. Users searching for a desktop client for Anthropic’s Claude interface are directed to GitHub repositories and deceptive websites. The download arrives as a 64-bit Electron application packaged inside a 101-megabyte archive. While the victim expects a fully functioning conversational interface, the application runs entirely in the background without creating a visible window.
Instead, the loader extracts a highly guarded payload. The file is stored as an AES-256-CBC-encrypted resource inside the core application. Once the loader clears its extensive pre-execution checks, it decrypts the file and writes it to the local Windows AppData directory under a randomized name. It immediately launches the execution of the RevStealer crypto malware. To prevent immediate detection, the loader attempts to insert the Windows AppData directory directly into the Microsoft Defender exclusion list.
The software exhibits high structural complexity. Rather than launching its primary threat payload immediately, the loader carefully evaluates the environment to determine if security analysts are monitoring the system. The software checks the device to ensure it possesses at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics card. If the device falls short of these hardware benchmarks, execution halts.
Hostnames and usernames are matched against a dedicated blocklist composed of known malware analysis setups. A critical anti-analysis mechanism includes a high-precision timing test. The loader measures the exact latency around a JavaScript debugger instruction. If a human analyst or debugger pauses the process for longer than roughly 100 milliseconds, the program wipes its entire encoded string table, rendering the payload useless to researchers.
Beyond virtual hardware tests, the native compilation stage introduces 10 distinct checks. These checks produce a weighted score to evaluate whether the application is running in a virtual sandbox. The malware also reads local system language settings. It instantly shuts down if it identifies the local system language as Russian, Ukrainian, or any of several Central Asian languages.
For automated sandboxes that bypass these checks, the program presents a manual CAPTCHA barrier. Human interaction is mandatory for the infection to proceed. This prevents automated virtual machines from easily analyzing the final stages of the payload. “Every stage of it is engineered around the assumption that something is watching,” said Shmuel Uzan, researcher at Morphisec.
Once execution begins, the malware operates at extreme speed to avoid detection. It bypasses standard Windows APIs entirely, eschewing the traditional import table that security products monitor. Instead, it utilizes 14 indirect system-call wrappers to directly access the Windows kernel. This architecture renders standard Endpoint Detection and Response tools virtually blind to the underlying operating system calls.
Once authorized on a cleared machine, the malware systematically harvests highly sensitive digital records. The target list is massive, covering browser databases, active encryption keys, and browser extension local storage. The software successfully extracts data from Windows Credential Manager, 12 separate password managers, and more than 50 cryptocurrency wallets. It also sweeps for active browser session cookies.
These captured session cookies represent a critical vector for modern financial theft. Even when investors secure their accounts with robust multi-factor authentication, valid cookies allow hackers to hijack active sessions. Attackers bypass the entire login phase, evading the need for usernames, passwords, or secondary authentication keys.
The malware also seeks out local VPN configurations, remote desktop credentials, active clipboard data, messaging applications, system screenshots, and gaming platforms. The gathered data is organized into heavily encrypted, typed records and pushed directly to the hackers’ command-and-control server.
The infrastructure itself is built for high resilience. If the primary command-and-control server goes offline, the malware extracts a fallback address stored directly within a smart contract on the Polygon blockchain. This decentralized retrieval system allows operators to alter their backend server infrastructure on the fly, eliminating the need to compile and redistribute updated files.
Unlike older-generation trojans that establish continuous persistence through registry edits or scheduled startup tasks, this threat operates with high efficiency. It acts as a single, devastating burst of information theft. It captures the available credentials, transmits them, and promptly deletes itself to leave no forensic footprint.
“The credentials, cookies, and wallet material may already be gone by the time a detection system produces an alert for review,” Morphisec warned in its security advisory.
This sophisticated AI-themed deception represents a growing trend of social engineering targeting the broader cryptocurrency market. Cybercriminals are increasingly using high-value software names, entertainment titles, and business communication apps to deliver advanced stealers. Just last month, fake downloads of the movie “The Odyssey” were discovered distributing Lumma Stealer through false video formats.
Similarly, elite cyber groups have targeted crypto organizations using lookalike meeting platforms. The North Korea-affiliated BlueNoroff group designed fake Zoom and Microsoft Teams update screens, executing PowerShell loaders to compromise local Ethereum and Solana wallets. Another highly modular framework, OkoBot, deployed 20 different modules to capture clipboard data, keylogs, and seed phrases from Ledger and Trezor hardware wallets.
The widespread success of these information-stealing applications has drawn the direct attention of global federal authorities. In May 2025, the United States Department of Justice successfully targeted LummaC2, a comparable commercial malware operation that had facilitated more than 1.7 million successful information-theft incidents. The federal action seized five primary internet domains and disrupted over 2,300 supporting server nodes.
Criminals utilize advanced infostealers like LummaC2 to harvest confidential login details from massive pools of victims, paving the way for malicious acts such as unauthorized financial wire transfers and digital asset theft, explained Matthew Galeotti, former head of the Justice Department’s Criminal Division.
Despite aggressive state-level crackdowns, the financial incentives of these rapid-theft operations ensure that developers will continue to refine their delivery. Investors must remain hyper-vigilant, ensuring they download applications exclusively from verified official developers and maintain rigorous device isolation for physical cryptocurrency keys.
Editorial Note: This article was researched and drafted with AI assistance, then rigorously fact-checked, edited, and published by Miles. All content is strictly for informational and educational purposes only and does not constitute professional investment advice. Cryptocurrency and global financial markets experience severe volatility, sometimes swinging 50% or more in a single day. Invest only capital you can comfortably afford to lose, and always consult a certified financial advisor before committing funds. Read my full Disclaimer for more details.