In early September 2026, Morphisec Threat Labs uncovered a campaign where a fake GitHub repository called “Claude-Opus-5-Free-Desktop” was distributing malware. At first glance the repo looks legitimate with screenshots, model comparisons and a roughly 100 MB ZIP file for download. But anyone who downloads and runs it does not get an AI tool, they get the infostealer “RevStealer”, and the technical sophistication of this thing is at a level you rarely see in campaigns like this.
How it works
The ZIP contains a 64-bit Electron app. After launching it nothing happens: no window, no interface, no indication that anything is running at all. In the background however an elaborate verification process starts before the actual malware even becomes active.
Ten separate checks run, requiring at least 2 GB RAM and two CPU cores while the graphics card is checked against a list of known manufacturers. The hostname and username are compared against 14 keywords (things like “malware”, “sandbox”, “currentuser”, “johnson”), and a JavaScript timing check with a roughly 100 millisecond threshold detects debuggers; if one is running the encrypted strings are destroyed immediately.. On top of that there is a scoring system: the more checks that trigger, the more likely the environment is an analysis sandbox.
One detail that stands out: on systems with Russian, Ukrainian or Central Asian language settings the malware terminates immediately, which gives a fairly clear indication of where the developers are based.
Technical details
Only after all checks pass does the actual payload get decrypted (AES-256-CBC, embedded in the Electron app’s resources) and written to a randomly named folder under AppData. Before that the loader tries to add the AppData folder to Windows Defender’s exclusion list (this might not always work, but it costs nothing to try).
The native payload itself resolves Windows APIs without a normal import table and uses 14 indirect syscall wrappers to bypass user mode hooks. The configuration stays encrypted until the moment of use; vectored exception handlers protect the collection routines. At the time of analysis only 1 out of 66 antivirus engines detected the malware, which is a number that really should give you pause.
What gets stolen
The list is long: browser databases, cookies, saved passwords, extension data, Windows Credential Manager, over a dozen password managers, more than 50 crypto wallet apps, VPN and remote access credentials, messaging apps, game launcher accounts, OBS profiles, clipboard content, screenshots and selected documents. RevStealer streams the data directly to the C2 server instead of storing it locally in an archive, which makes forensic recovery practically impossible.
And if the primary C2 server is unreachable the malware reads a fallback address from a smart contract on the Polygon blockchain, so the operators can rotate their infrastructure without losing contact with deployed instances…
After exfiltration RevStealer deletes itself, no persistence, no registry keys, no scheduled tasks. Classic smash and grab.
Why this works
“Free AI tool” is the perfect lure in 2026 because everyone wants access to the latest models and not everyone checks whether a GitHub repo actually belongs to Anthropic (the official repo is named differently by the way). Game cheat sites serve as a second distribution channel which covers an entirely different target demographic. The campaign also shows how far infostealer malware has evolved technically: blockchain based C2 infrastructure, indirect syscalls, CAPTCHA gating against automated analysis; this is not a script kiddie project but professional malware development.
Protection
- Only download AI tools from official websites (claude.ai for Claude, not some random GitHub repo)
- Always verify the account behind GitHub repos: is it actually the official Anthropic repository?
- Electron apps that don’t open a window are inherently suspicious
- “Free access” to premium AI models does not exist, it is almost always a lure
- EDR solutions that do behavioral analysis rather than relying solely on signatures (with 1 out of 66 detection rate, signatures are worthless)
The Morphisec researchers (Shmuel Uzan) published their anlaysis on September 1st. Whether the repo had been removed by the time of publication was unclear, but even if it has been: the next fake repo is probably already online. Whether it will be called “Claude Opus 6” or “GPT-5 Free Edition”, the pattern remains the same…