The most dangerous code isn't hiding in a smart contract. It’s sitting on a fake download page, masquerading as a Claude desktop app. This isn’t a DeFi exploit. It’s an infostealer campaign targeting the intersection of AI hype and crypto naivety. Over the past week, I’ve traced the operational fingerprint of RevStealer—a malware variant that claims to be the official Anthropic client but instead exfiltrates over 50 cryptocurrency wallets, browser credentials, session cookies, and specific document types. The attack is live, and the vector is pure social engineering.
Let me be clear: this is not a zero-day or a protocol bug. It’s a distribution problem. The code is not new. The tactics are not sophisticated. But the targeting is precise. RevStealer is a fork of the RedLine infostealer lineage, modified to specifically hunt for wallet files and private keys. The campaign leverages the current AI-crypto convergence narrative—users are eager to try Claude’s desktop integration, and attackers are exploiting that urgency.
Context: The Attack Surface
RevStealer is distributed through fake download sites that mimic the official Claude desktop app landing page. The malware is a single executable, typically around 2.5 MB, compiled with .NET obfuscation. Upon execution, it performs the following steps:
- Persistence: Writes a registry run key to ensure it survives reboots.
- Data Harvesting: Scans for wallet files (e.g.,
wallet.dat,keystore.json,1) across common paths (AppData,Documents,Desktop). - Credential Theft: Extracts saved passwords and cookies from Chrome, Firefox, Edge, and Brave.
- Document Exfiltration: Targets
.txt,.doc,.pdf,.xlsfiles containing keywords like “crypto”, “seed”, “password”, “ledger”. - C2 Communication: Sends the stolen data to a remote server via HTTP POST, often using a
cloudflare-like domain to evade detection.
The malware targets over 50 wallets, including MetaMask, Ledger Live, Exodus, Electrum, and Atomic. The list is not exhaustive—it’s a dynamic configuration that can be updated remotely.
Core: Technical Dissection
I acquired a sample of the RevStealer binary through a threat intelligence feed. I ran it inside a sandboxed environment (Windows 10, no network) to analyze its behavior statically and dynamically. Here’s what I found:
Obfuscation: The executable uses ConfuserEx, a common .NET protector. The string table is encrypted with AES-128, key derived from a hardcoded GUID. Decryption reveals the C2 endpoint: hxxp://revstealer[.]top/gate.php.
Wallet Detection: The malware iterates through a hardcoded list of wallet directories. For each, it checks if the file exists and is readable. It then reads the entire file into memory and compresses it using GZip before appending to a multipart POST request. The request includes a unique victim ID (generated from the machine’s hardware ID).
Browser Credential Theft: RevStealer uses the SQLite library to read the Login Data and Cookies files from Chrome’s profile directory. It decrypts the passwords using the CryptUnprotectData Windows API, which requires the user’s login session. This means the malware only works on machines where the user is logged in—another sign that the attack vector is the desktop app, not a remote exploit.
Comparative Benchmarking: I compared RevStealer’s feature set with two other common infostealers: RedLine and Raccoon.
| Feature | RevStealer | RedLine | Raccoon | |---------|------------|---------|---------| | Wallet count | 50+ | 30+ | 20+ | | Browser credential theft | Yes (Chrome, Firefox, Edge, Brave) | Yes (Chrome, Firefox) | Yes (Chrome, Firefox) | | Document exfiltration | Yes (keyword-based) | Yes (limited) | No | | Anti-VM detection | No | Yes | Yes | | C2 protocol | HTTP POST | HTTP POST | TCP socket | | Persistence mechanism | Registry run key | Scheduled task | Registry run key | | Obfuscation | ConfuserEx | Custom .NET | SmartAssembly |
RevStealer is not the most advanced, but its wallet coverage is broader. It’s a focused tool for crypto theft.
Trade-off: The lack of anti-VM detection makes it easier for security researchers to analyze, but the campaign is still active because the distribution channels are decentralized. The attackers are not trying to evade sandboxes; they are relying on volume and trust.
Contrarian Angle: The Real Blind Spot
Most security analysis of this event will focus on the malware itself. But the blind spot is the ecosystem’s assumption that users will verify software provenance. The attack does not exploit any technical vulnerability in Claude or the blockchain. It exploits the disconnect between the promise of AI agents and the reality of user behavior.
We are seeing an emerging pattern: every new AI-crypto product launch triggers a wave of fake versions. Last month it was a fake ChatGPT plugin for crypto trading. This month it’s Claude. Next month it will be a fake AI agent framework. The attackers are not coding exploits; they are coding trust decoys.
From my experience auditing ZK-Snark contracts, I know that the most overlooked vulnerabilities are often not in the protocol logic but in the user interface. Here, the UI is the fake download page. The “code” is the social engineering. Until the industry treats distribution security as seriously as smart contract security, these attacks will continue.
Takeaway: Vulnerability Forecast
RevStealer is a symptom, not the disease. The disease is the lack of robust verification mechanisms for AI-crypto clients. Expect a surge in similar campaigns targeting the upcoming wave of AI agent frameworks. The chain is fast; the settlement is slow. The settlement here is the user’s trust.
Proofs verify truth, but context verifies intent. In this case, the context is a fake download link. The proof is the malware’s signature. The intent is theft.
Scalability is a trade-off, not a promise. The scalability of deception is infinite.
Logic holds until the gas price breaks it. The gas price here is the cost of a single click.
Actionable Risk Checklist 1. Only download software from the official GitHub or website (check SSL certificate, domain creation date). 2. Use a hardware wallet for all significant crypto holdings. 3. Run a full antivirus scan on any machine that has been used to download desktop apps in the past month. 4. Change all passwords and rotate API keys immediately. 5. Monitor your wallet addresses for unexpected outgoing transactions.
This attack will not be the last. The AI-crypto convergence is a goldmine for attackers because it combines two high-trust narratives. The market will eventually price in this risk, but until then, the burden is on the user. And the user is always the weakest link.
