According to CoinMeta, a cybersecurity company reported that a counterfeit Claude desktop application is spreading RevStealer malware, aimed at stealing data from over 50 cryptocurrency wallets and password managers. The malware is distributed by posing as an electronic application called “Claude Opus 5 Free Desktop,” taking advantage of the brand image of Anthropic. Morphisec indicated that the malware is spread within GitHub projects with a Claude theme, exploiting people's interest in paid AI tools to encourage users to install unverified software. The download package, which is approximately 101 megabytes in size, contains a 64-bit electronic application. Although victims expect to see the normal Claude interface, the program prepares an encrypted payload in the background and attempts to add users' application data folders to a Microsoft Defender blocklist. Morphisec stated that this process is designed to reduce evidence while quickly collecting and transmitting information.