On September 1, cybersecurity company Morphisec released a report pointing out that someone had created a project on the code hosting platform GitHub called "Claude-Opus-5-Free-Desktop," claiming to allow free use of the paid AI model Claude Opus 5.
The download file it provided was called ClaudeOpus5-desktop.zip, about 101 MB in size. The page also included screenshots and a performance comparison table, making it look just like a normal open-source project.
After the downloader clicks and runs it, no window pops up on the screen. What it actually installs is a Windows credential-stealing program called RevStealer.
According to the Morphisec report, what this program searches for on the computer includes:
Account credentials and cookies stored in the browser
Stored data of browser extensions
Files from a dozen or so password managers
Files from more than 50 cryptocurrency wallet programs
Login credentials for VPN and remote connections
Messaging app data, screenshots, and some documents
After it gets what it wants, it will send the data directly to the attacker’s server, and then delete itself from this computer.
◆◆◆
A screenshot in the Morphisec report shows that at the time this file was sent for scanning, out of 66 antivirus engines, only 1 flagged it as malware.
That means if you had installed antivirus software at the time, and it happened to not be the one that flagged it, then your computer would show no abnormal signs.
Additional note: before it takes action, it will first compare your memory, the number of CPU cores, and the graphics card model to determine whether this computer looks like a test environment used by a cybersecurity company to dissect viruses. If it looks like that, it will stop on its own.
Also, the file isn’t just hosted on GitHub—these hackers distributed it by posting it on websites for game mod/plug-in themes.
So what does this have to do with someone who buys crypto in Taiwan?
The connection is that this time the bait is not “guaranteed profit,” and not an “automatic arbitrage bot,” but rather a mindset of “wanting to save on subscription fees.”
◆◆◆
Based on my observations, people who get exposed to this kind of thing are usually not completely computer-illiterate elders, but rather those who are more familiar with computers than the average person. Because finding projects on GitHub, extracting compressed files, and running the files inside—these actions already have a learning barrier.
It’s just that for Taiwanese people, the words “free version” and “cracked version” are tied to a kind of bodily memory. From old unzip tools and video players to today’s AI tools, our first reaction is often to look for whether someone has released a free version.
However, the cost of this habit on cryptocurrency is completely different from elsewhere… If a credit card is used fraudulently, the bank has a dispute-chargeback process you can go through. If a banking account is compromised, there’s also customer service and the police you can contact.
But once the seed phrase (the set of passwords that restores the wallet) has been copied, it only takes the other party a few seconds to transfer your coins. And once that transaction is completed on the blockchain, there’s no customer service, no dispute process, and no cancel button you can press.
So I believe most people’s cybersecurity budgets are spent in the wrong places. We’re willing to pay an annual subscription for antivirus software, but we rarely spend even ten minutes thinking about one question: how much on this computer is something that can directly lead to money being stolen.
Today, try doing two things:
First, open your browser’s extension list and remove any wallet extensions you don’t use anymore but that are still hanging around.
Second, if there are any software on your computer that are “free versions” or “cracked versions,” try to remember where you downloaded them from. If you can’t remember, assume there’s a problem and remove them as soon as possible.
⚠️ The content above is for reference only and does not constitute any investment advice.