A new Windows infostealer dubbed “RevStealer” is being spread through a GitHub repository offering a fake free version of Anthropic’s Claude Opus 5 model, Morphisec
reported Monday.
RevStealer layers evasion measures, including sandbox checks, string encryption, stealthy API resolution, indirect system calls and incremental data exfiltration to remain mostly invisible to endpoint security systems.
The infostealer targets browser data and extensions, Windows Credential Manager and third-party password managers, cryptocurrency wallets, VPN and remote-access credentials, gaming profiles, messaging applications, user documents and more.
Stolen data is streamed to an attacker-controlled server as it becomes available in memory without staging a large archive on disk, with a fallback command-and-control (C2) address stored on a smart contract on the Polygon blockchain, providing added resilience and flexibility.
Related reading:
“RevStealer is not novel in what it steals. Browser databases, wallet files, password-manager artifacts and session tokens have been the standard haul for years. What makes it worth studying is how thoroughly it is engineered around the assumption that someone is watching,” Morphisec Security Researcher Shmuel Uzan wrote in a report.
‘Claude Opus 5 Free Desktop’ leads to Electron loader
RevStealer is spread through GitHub repositories and game cheat websites, with the main version analyzed coming from the GitHub repository claude5opus/Claude-Opus-5-Free-Desktop. Installing the ClaudeOpus5-desktop.zip archive from the repo and running the contained executable launches an invisible Electron application that serves as a loader for the infostealer.
Without displaying any window or user interface, the loader performs anti-sandbox analysis including checks for at least 2 GiB of physical memory, at least two logical CPU cores, at least one recognized graphics adapters based on a hardcoded list of vendors, and hostnames and usernames that don’t match a blocklist of 14 keywords including johnson, miller, bruno, george, malware, maltest, currentuser and sandbox.
If the sandbox checks pass, the loader attempts to exclude the AppData directory from Microsoft Defender scanning without elevating privileges and then decrypts the embedded payload and writes it under AppData regardless of whether the exclusion succeeded. After launching the RevStealer payload in a hidden window it attempts to delete the executable and its staging directory but ignores failures, potentially leaving these artifacts behind, the researchers noted.
The researchers also highlighted that at the time of their analysis, RevStealer only had one detection on VirusTotal and a community score of -54, with one victim posting in a forum discussion that their Microsoft and Electronic Arts accounts were compromised within hours of installing the malware.
RevStealer aims to remain invisible before, during and after data theft
In addition to the anti-sandbox checks performed by the Electron loader, the RevStealer payload performs its own checks for debuggers, network-analysis programs, process-monitoring tools and virtualization software using a weighted scoring system that considers characteristics including available memory, CPU configuration, process count, graphics hardware and system uptime.
In some builds, the stealer displays a 6-character CAPTCHA and terminates if the window is exited or an incorrect response is provided, further blocking automated tools. The malware also terminates if the UI language, system language or active keyboard layout match languages including Russian, Ukrainian, Belarusian, Tajik, Armenian, Azeri, Kazakh, Kyrgyz, Turkmen and Uzbek.
RevStealer conceals its Windows API resolution by walking the Process Environment Block (PEB) at runtime and hashing exported function names rather than using a typical import table. It also conceals its behavior from static analysis by encrypting strings and configuration information and decrypting them only at the time of use.
The malware utilizes indirect syscall wrappers for 14 operations to avoid exported entry points where monitoring hooks may be triggered. After establishing contact with its C2 server, it sends a 17-field system fingerprint along with a snapshot of installed software, running processes, environment variables, clipboard contents and a desktop screenshot.
If the main C2 server becomes unavailable, the malware sends Polygon JSON-RPC eth_call requests to a smart contract on the Polygon blockchain containing a fallback address, which can be easily rotated without needing to rebuild the malware, the researchers noted.
During the infostealing process, the malware’s collectors write the stolen content to in-memory buffers, encrypts it with AES-128-CBC and then base64-encodes the result, sends it in a JSON envelope via WinINet impersonating Chrome 147 to blend in with normal browsing traffic, and then releases the buffers. Larger bundles of data are compressed with a built-in DEFLATE implementation, but the malware avoids staging an archive of stolen data on the disk, streaming the data as it becomes available to minimize its disk footprint, the researchers said.
RevStealer targets data from Chromium- and Gecko-based browser databases, cryptocurrency and password manager extensions, 11 password managers, 51 cryptocurrency wallets, six gaming profiles and launchers, OBS streaming profiles, six messaging applications, six VPN providers, four remote-access and file transfer protocol (FTP) programs, the Windows Credential Manager and three users directories (Desktop, Documents and Downloads) along with OneDrive, Dropbox and Google Drive drives.
To obtain keys protected by Chromium’s App-Bound Encryption, the stealer starts a Chrome- or Edge-derived process under debugger control on a private desktop and places a hardware breakpoint to intercept the App-Bound key from the browser’s process, the researchers explained.
For document theft, the file collector specifically targets files with the extensions .txt, .md, .csv, .json, .doc, .docx, .xls, .xlsx, .pdf, .cfg and .kdbx.
The malware does not leave behind persistence mechanisms such as scheduled tasks, registry Run keys or startup entries, instead focusing on “a single short burst of theft,” the researchers concluded. “By the time a detection product produces a verdict and hands it to an analyst, the credentials, cookies and wallet materials are already gone. Response here is not slow, it is structurally too late,” the report states.
