Scammers Distribute Fake Claude AI Apps to Steal Crypto Wallet Data

Cybersecurity researchers have identified a counterfeit "Claude Opus 5 Free Desktop" application being shared on GitHub. The program claims to provide free access to Anthropic’s premium AI models, but instead installs the Revstealer infostealer on Windows systems.

How the Scam Works

The malicious installer pretends to offer a free version of the paid Claude AI model. Once executed, it copies encrypted wallet files, browser databases, password manager entries, and VPN configurations without attempting to decrypt them. The collected data is then compressed and uploaded to the attackers’ servers.

Targeted Crypto Wallets

• Atomic
• Armory
• Cake Wallet
• Sparrow
• Wasabi
• Ledger Wallet
• Trezor Suite
• Electrum

Because the malware only extracts the encrypted files, the ultimate success of the theft depends on the strength of the wallet passphrases or the reuse of credentials stored elsewhere.

Broader Credential Theft

One reported victim saw additional account compromises, including Microsoft and EA accounts, after the infection. The infostealer can evade detection, delete itself, and harvest a wide range of credentials beyond crypto assets.

Why This Is Likely to Grow

The release of Anthropic’s Fable 5.1 and Mythos 5.1 models has increased demand for AI tools. Scammers may soon use the promise of "free" or "exclusive" access to these newer models as bait, especially since Mythos 5.1 is only available through Anthropic’s trusted programs.

Protective Measures

• Verify the source of any AI software before downloading.
• Use strong, unique passphrases for wallet encryption.
• Employ reputable security software that can detect infostealers.
• Regularly back up wallet files and store them offline.