A malicious desktop version of Anthropic's Claude AI is currently circulating to infect unsuspecting users with RevStealer malware by exploiting the high demand for AI productivity tools. Once downloaded and executed, the software bypasses standard security checks to scan the victim's machine for directories associated with more than 50 different cryptocurrency wallets. By targeting sensitive files such as wallet credentials and recovery seeds, the malware allows attackers to drain assets directly from popular software wallets and browser extensions.
Beyond immediate crypto theft, RevStealer acts as a comprehensive data harvester. It is programmed to extract browser cookies, saved login passwords, and private data from messaging platforms like Discord and Telegram. This allows hackers to compromise secondary accounts and potentially bypass two-factor authentication (2FA) measures, giving them long-term access to the victim's digital identity and financial ecosystem.
For the US crypto market, this campaign highlights a dangerous trend where attackers use the reputation of prominent AI brands to bypass user skepticism. Since Anthropic primarily offers Claude through web interfaces and official APIs, hackers are filling the 'desktop app' void with malicious clones. This tactic is particularly effective against retail investors who may be looking for native applications to streamline their AI-assisted trading or research workflows.
Investors and tech enthusiasts should remain vigilant and only download software from verified, official developer websites. As the intersection of AI and crypto continues to grow, industry analysts expect an increase in 'brand hijacking' attacks. The community should watch for official security advisories from Anthropic and wallet providers, as well as potential updates to antivirus definitions that specifically target the RevStealer signature.