Fake Claude Desktop App Distributes Crypto-Stealing Malware

How RevStealer Evades Detection

A malicious software campaign has emerged that disguises itself as a legitimate Claude AI desktop application to steal cryptocurrency and sensitive user data. First identified in early September 2026, the malware, named RevStealer, targets over 50 different cryptocurrency wallets while also harvesting browser passwords, cookies, messaging app data, and selected documents from infected systems. Security researchers warn that the fake app is being distributed through phishing websites and deceptive download links designed to mimic official AI software platforms.

The attack begins when users unknowingly download a counterfeit version of the Claude desktop client, believing it to be a genuine productivity tool. Once installed, RevStealer operates silently in the background, scanning for digital wallets associated with popular cryptocurrencies such as Bitcoin, Ethereum, and lesser-known altcoins. It extracts private keys and seed phrases, enabling attackers to drain funds without detection. In addition to financial theft, the malware harvests login credentials from web browsers, session cookies from social media and email platforms, and chat logs from messaging applications. It also searches for specific document types that may contain sensitive personal or corporate information.

What Makes This Campaign Particularly Dangerous?

Security analysts note that the malware uses code obfuscation and process injection techniques to avoid detection by traditional antivirus software. By mimicking legitimate system processes and encrypting its communications with command-and-control servers, RevStealer can remain active for extended periods. The malware also checks for virtual environments and sandboxes, terminating itself if it suspects analysis, which complicates forensic investigation. Researchers emphasize that the campaign’s success relies heavily on social engineering, exploiting user trust in well-known AI brands to bypass caution.

Unlike generic info-stealers, RevStealer combines broad data harvesting with a focused emphasis on cryptocurrency theft, reflecting the growing value of digital assets as a target for cybercriminals. Its ability to steal from more than 50 wallet types indicates a sophisticated understanding of the crypto ecosystem. Furthermore, the theft of messaging data and cookies increases the risk of secondary attacks, such as account hijacking or identity theft. Experts caution that even users who do not hold cryptocurrency are at risk due to the malware’s wide-ranging data collection capabilities.

How can users avoid downloading the fake Claude app? Users should only download software from official websites or verified app stores, avoiding third-party links or unsolicited emails offering AI tools. Checking digital signatures and verifying publisher information can help confirm authenticity.

Frequently Asked Questions

What should someone do if they suspect infection? Disconnect the device from the internet immediately and run a full scan using updated anti-malware tools. Change passwords for important accounts from a clean device and monitor financial and crypto accounts for unauthorized activity.

Is the real Claude AI application affected by this malware? No, the legitimate Claude AI software developed by Anthropic is not compromised. The threat comes solely from counterfeit versions distributed by attackers impersonating the brand.