A malicious GitHub repository impersonating Anthropic advertised a “free” Claude Opus 5 desktop app and tricked users into downloading a ZIP that silently installed RevStealer. Victims reported account takeovers after running it, and the malware is designed to steal passwords, crypto wallet data, and other sensitive information while deleting itself to reduce evidence.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you grab a 'free Claude Opus 5 desktop app' from GitHub… and a few hours later, your Microsoft account is taken over. That GitHub repo is fake. It impersonates Anthropic, tells you to download ClaudeOpus5-desktop.zip, you run it, no window pops up, while RevStealer silently starts streaming out your passwords and crypto, then deletes itself. Here’s the tell: it’s offering 'free' access to a premium Claude Opus 5 desktop app from an unofficial GitHub repo. And when you run the installer, nothing normal happens, no setup wizard, no prompts, just silence. If you ever run an installer for Claude, or any tool, and it does nothing, stop and report it to IT immediately. A silent install can mean silent credential theft.
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
A Russia-linked threat group compromised hotel WiFi captive portals to redirect guests to fake “verification” pages. Victims were pushed toward either copying commands into a terminal to install malware or entering Microsoft credentials on spoofed login pages that added an attacker-controlled…
Microsoft reported a campaign where attackers abused hotel Wi‑Fi captive portals to manipulate DNS/HTTP traffic and redirect people to attacker-controlled phishing pages. Victims were tricked into installing malware disguised as browser/operating system updates, and some pages redirected users into…
Microsoft reports a real-world campaign where attackers tamper with Wi‑Fi captive portal traffic at hotels and similar venues to redirect travelers to attacker-controlled pages. Victims are pushed into fake Microsoft sign-ins (device code/OAuth phishing) or tricked into installing “browser/OS…
