Researchers tied several new programs to the REVSTEALER Windows info-stealer that can steal crypto wallet data, hijack clipboard crypto addresses, and even disable Windows Update and Microsoft Defender to run a crypto miner. Victims are primarily pulled in through “game-cheat” downloads promoted by hijacked YouTube channels and through impersonated/pirated software such as a fake “Claude Opus 5 Free Desktop” app. The write-up includes enough real-world lure and delivery workflow details to build realistic awareness simulations around risky downloads and fake software branding.
REVSTEALER primarily reaches victims through two lure paths that both rely on trust in familiar-looking content rather than technical exploitation. The first is game-cheat lures: researchers found at least 17 YouTube channels, many hijacked from their original owners, promoting cheat websites through short AI-generated videos. The second is impersonated or pirated software, most notably a fake "Claude Opus 5 Free Desktop" application that copied Anthropic's branding to appear legitimate, even though Anthropic itself was not compromised.
Once a victim downloads and runs the installer, associated modules such as LockAppHost can disable Windows Update services and weaken Microsoft Defender protections before launching a cryptocurrency miner with elevated privileges. Another module, WinUpdate, monitors the clipboard and replaces copied cryptocurrency addresses with attacker-controlled ones while also scanning for recovery phrases.
The scheme works because it targets everyday behaviors: gamers looking for an edge and users seeking free access to a paid AI tool. Hijacked YouTube channels lend false credibility to cheat promotion, and copied branding on the fake AI app removes the usual visual cues people rely on to judge legitimacy. Because the core stealer deletes itself after establishing the additional modules, victims may believe the threat is gone even though components remain resident and active.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It reaches victims mainly through game-cheat lures, including hijacked YouTube channels that use short AI-generated videos to promote cheat websites. It has also been packaged as pirated or impersonated software, such as a fake Claude Opus 5 Free Desktop app.
Associated modules can disable Windows Update services and weaken Microsoft Defender protections, then run a cryptocurrency miner with elevated privileges. One module also swaps clipboard cryptocurrency addresses and searches for recovery phrases.
No. The fake app copied Anthropic's branding to appear legitimate, but there is no indication Anthropic itself was compromised.
No. Because the stealer can take session cookies and browser encryption keys, affected users should end active sessions on their accounts rather than assume a password reset alone is sufficient.
You’re on YouTube, see a short clip: “New aim-assist cheat, 100% safe, link in description.” You click. The site offers a “ProManager cheat installer.” You run it, thinking it’s just for games, but it’s REVSTEALER. It can grab your crypto wallets, hijack clipboard addresses with WinUpdate, and even drop a miner after LockAppHost weakens Microsoft Defender. Same trick with apps: a site pushing “Claude Opus 5 Free Desktop” using Anthropic branding. Looks polished, but it’s just REVSTEALER in a costume, and the core stealer can delete itself so you think it’s gone while its modules keep running. Aha moment: if a cheat, crack, or “free” Claude desktop app isn’t from an official store or the vendor’s own site, treat it as REVSTEALER. Your move: don’t install it, report the link to IT and walk away.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Researchers demonstrated a new “agent data injection” technique where attackers plant content (like a review or GitHub comment) that an AI agent mistakenly treats as trusted system data. In tests, this caused web-browsing agents to click the wrong buttons (e.g., “Buy Now”) and coding agents to run…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
The roundup describes multiple real-world attacks where criminals manipulate people, not just systems, such as fake bank support calls that trick victims into installing phone malware, and “ClickFix” lures that convince Mac users to run malicious commands. It also highlights an AI-assisted…
