Poisoned Pipeline / Incidents / AS290
RevStealer trojanized Electron apps via fake Claude desktop and cheat sites
Git / GitHubWindows softwareAI coding agents
Morphisec Threat Labs documented RevStealer, a Windows infostealer
delivered inside trojanized Electron desktop applications distributed
through GitHub repositories and game-cheat-themed sites. The notable
lure is a fake "Claude Opus 5 Free Desktop" project impersonating
Anthropic and advertising free access to a paid AI model. The theft
itself is ordinary — browser databases, session cookies,
cryptocurrency wallets, password-manager artifacts, and VPN
configurations — but every stage is engineered around the assumption
that something is watching: exfiltration is in encrypted typed
records and the stealer deletes itself after the haul.
Mapped techniques
- T0110 Advertise malicious artifact
- T0136 Brandjacking
- T0197 Use code from untrusted source
- T0159 Malicious artifact execution
- T0184 Harvesting sensitive information from files
supply-chain trojanized desktop distribution
Game-cheat-themed sites and the fake Claude desktop project
advertise free access to a paid AI model.
Impersonates Anthropic; the "Claude Opus 5 Free Desktop" project
borrows the vendor's name to pass cursory inspection.
Distributed from GitHub repositories and cheat sites, outside
any vetted package registry.
post-supply-chain Windows victims executing the stealer
The trojanized Electron application runs the stealer when the
victim installs and launches it.
Browser databases, session cookies, wallet material,
password-manager artifacts, and VPN configurations.
Framework gaps noted
- Encrypted typed-record exfiltration and post-haul self-deletion are not named techniques; recorded as stealth behaviours.
- A fake AI-model desktop application as a lure has no dedicated technique beyond T0136 brandjacking.