RevStealer is a Windows information stealer delivered inside a trojanized Electron desktop application that impersonates legitimate software. Morphisec Threat Labs observed it distributed through GitHub repositories and game-cheat-themed sites, with the most notable lure a fake “Claude Opus 5 Free Desktop” project that impersonates Anthropic and advertises free access to a paid AI model.
The theft itself is ordinary. Browser databases, session cookies, cryptocurrency wallets, password-manager artifacts and VPN configurations have been the standard infostealer haul for years. What makes RevStealer worth studying is that every stage of it is engineered around the assumption that something is watching.
Key Takeaways
- RevStealer is distributed through a fake “Claude Opus 5 Free Desktop” GitHub repository, making demand for AI tooling a first-class social engineering surface.
- The Electron loader validates memory, CPU, hostname and GPU before decrypting anything, so a sandbox that fails a check never sees the payload.
- The native payload resolves Windows APIs without an import table and calls the kernel through 14 indirect syscall wrappers, bypassing the exported functions where user-mode monitoring hooks sit.
- If the primary C2 is unreachable, RevStealer reads a fallback address from a smart contract on the Polygon blockchain, letting operators rotate infrastructure without rebuilding the malware.
- There is no persistence and no dwell time. The theft is a single short burst, which makes detect-and-respond structurally too late.
What Is RevStealer?
RevStealer is a stealth-focused Windows infostealer that collects credentials, browser data and cryptocurrency wallet material, exfiltrates it in encrypted typed records, and then deletes itself. It is delivered by an Electron loader that hides an AES-encrypted native payload inside an application resource, attempts to add the user’s AppData folder to Microsoft Defender’s exclusion list, and launches the payload with no visible window.
Confirmed collection targets include browser databases and encryption keys, extension storage, Windows Credential Manager, a dozen password managers, more than fifty cryptocurrency wallets, VPN and remote-access credentials, messaging applications, game launchers, OBS streaming profiles, clipboard contents, screenshots and selected user documents.
Inside the Attack Chain
The victim downloads a roughly 101 MB archive from a repository dressed in Claude branding. The enclosed executable is a 64-bit Electron application that creates no window and no user interface at all. Before it does anything else, it checks the host: at least 2 GiB of physical memory, at least two logical CPU cores, a hostname and username absent from a blocklist, and a recognized graphics adapter. A timing check around a JavaScript debugger statement wipes its encoded string table if execution pauses for more than roughly 100 milliseconds.
Only after those gates pass does the loader decrypt the embedded AES-256-CBC resource, write the native payload to a randomly named directory under AppData, launch it hidden and detached, and attempt to delete its own staging file.
The native stage adds its own gauntlet: a weighted ten-test anti-VM score, a regional exclusion that terminates on Russian, Ukrainian and several Central Asian language settings, and a CAPTCHA window that stops automated execution outright. It then registers a vectored exception handler so that a fault in one collector does not end the theft session, and pulls its C2 configuration out of encrypted storage only at the moment of use.
Why Detection-First Security Cannot Keep Up
Every evasion RevStealer implements is aimed at a specific detection surface. Runtime string decryption defeats signatures. Concealed API resolution and indirect syscalls defeat behavioral telemetry that watches exported functions. VM scoring and the CAPTCHA gate defeat automated analysis. Streaming exfiltration instead of building one on-disk archive defeats artifact collection, and self-deletion removes what is left.
The result is a deliberately thin evidentiary footprint and no dwell time. There is no scheduled task, no Run key, no startup entry. This is a single short burst of theft. By the time a detection product produces a verdict and hands it to an analyst, the credentials, cookies and wallet material are already gone. Response here is not slow; it is structurally too late.
The blockchain failover compounds the problem. When the primary server is unreachable, RevStealer queries a Polygon smart contract for a replacement address, blunting the seizure-based disruption that defenders normally rely on to end a campaign.
Prevention Before Execution: The Morphisec Approach
Morphisec takes a prevention-first approach built on Automated Moving Target Defense (AMTD), which is well suited to exactly these properties. None of RevStealer’s evasion helps against a technique that never tries to identify the malware in the first place. AMTD morphs the runtime memory environment so the assumptions the payload depends on — resolved function addresses, syscall gadget locations, predictable browser memory — are invalid at the moment it executes. Prevention is deterministic and pre-execution, with no verdict and no analyst in the loop.
The Morphisec Anti-Ransomware Assurance Suite extends this across the chain. Infiltration protection stops the loader before collection begins. Deception places decoy credentials in memory and browser storage, so a stealer reaching for them exposes itself. Impact protection covers the operator-delivered payloads that RevStealer’s tasking channel exists to deliver. Adaptive Exposure Management reduces the surface these campaigns rely on, including the user-scoped Defender exclusion this loader attempts to create.
Prevention Beats Detection Every Time
Attackers will keep changing lures, packaging, hashes and infrastructure to slip past tools that hunt for known indicators. A GitHub repository impersonating an AI vendor today is a different lure tomorrow. Prevention works differently: it targets the execution techniques the chain depends on, which stays effective even as the variants change.
Against a threat built to be silent, the objective is not faster detection. It is making the execution environment itself unreliable, so the theft never completes.
Download the Full Technical Analysis
Morphisec Threat Labs conducted a deeper technical investigation into RevStealer, including the complete reverse-engineering analysis of the Electron loader and the native payload, the Polygon-based command-and-control failover mechanism, and the full indicator set for security teams.
Download the full RevStealer threat analysis (PDF) to explore the complete research:
Stay up-to-date
Get the latest resources, news, and threat research delivered to your inbox.
