{"id":77651,"date":"2026-09-03T06:48:08","date_gmt":"2026-09-03T06:48:08","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/dont-fall-for-btc-stealing-fake-claude-apps-as-fable-5-1-and-mythos-5-1-released\/"},"modified":"2026-09-03T06:48:08","modified_gmt":"2026-09-03T06:48:08","slug":"dont-fall-for-btc-stealing-fake-claude-apps-as-fable-5-1-and-mythos-5-1-released","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/dont-fall-for-btc-stealing-fake-claude-apps-as-fable-5-1-and-mythos-5-1-released\/","title":{"rendered":"Don&#8217;t Fall for BTC-Stealing Fake Claude Apps as Fable 5.1 and Mythos 5.1 Released"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Fake Claude desktop app is already being used to spread the Revstealer infostealer targeting crypto asset wallets.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">The malware steals encrypted wallet files, browser data, password managers, and VPN configurations without decrypting wallets itself.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Newly released Fable 5.1 and Mythos 5.1 could become attractive bait for scammers offering fake \u201cfree\u201d or \u201cexclusive\u201d access.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p>Cybersecurity researchers at Morphisec said they\u2019ve found <a href=\"https:\/\/engage.morphisec.com\/hubfs\/2026-PDFs\/RevStealer_ThreatAnalysis_5.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">a fake \u201cClaude Opus 5 Free Desktop\u201d app<\/a>, distributed via Github. It lures people by offering a \u201cfree version\u201d of the paid artificial intelligence (AI) model and tries to trick them into installing a Windows infostealer that targets various crypto asset wallets, among other things, such as browser databases, password managers, and VPN configurations. The targeted crypto asset apps are Atomic, Armory, Cake Wallet, Sparrow, Wasabi, Ledger Wallet, Trezor Suite, Electrum, and others, according to the researchers.<\/p>\n<h2>Secure Your Passwords<\/h2>\n<p>However, it\u2019s not clear how successful the attackers have been, especially when Ledger Wallet and Trezor Suite are just interfaces for managing a hardware wallet.<\/p>\n<p>According to Morphisec, wallet files are simply copied as-is and may be compressed before being uploaded.<\/p>\n<p>\u201cNo product-specific password recovery, seed extraction or encrypted-wallet decryption occurs at this stage: Revstealer reliably steals the encrypted wallet material and configuration, while unlocking it depends on processing not demonstrated in this sample,\u201d they said.<\/p>\n<p>Therefore, if a wallet has a weak passphrase, reused credentials, or a password stolen from a password manager, criminals might get access to the funds. While not directly tied to crypto assets, one user said their device was infected with Revstealer after downloading what they believed to be legitimate software from Github.<\/p>\n<p>\u201cDespite the infection, their installed security product reportedly did not initially detect the malicious executable. The victim later reported that several online accounts, including Microsoft and EA accounts, had been compromised, illustrating how quickly an infostealer infection can lead to credential and session theft,\u201d the researchers said.<\/p>\n<p>Revstealer is designed to protect itself from detection and can even delete itself.<\/p>\n<h2>Another Social Engineering Threat<\/h2>\n<p>According to Morphisec, the \u201cfree access to Claude Opus 5\u201d case shows that demand for AI tooling is now \u201ca first-class social engineering surface.\u201d<\/p>\n<p>It may therefore be only a matter of time before criminals start impersonating and offering \u201cfree\u201d access to the <a href=\"https:\/\/www.anthropic.com\/claude-fable-and-mythos-5-1\" target=\"_blank\" rel=\"noopener noreferrer\">Fable 5.1 and Mythos 5.1 models that were released on September 1<\/a>. While Fable 5.1 is generally available, Mythos 5.1 can be accessed only via Anthropic\u2019s trusted programs, making it an even more attractive opportunity for scammers trying to trick people with \u201cexclusive access\u201d to Anthropic\u2019s most capable model.<\/p>\n<div class=\"not-prose my-3 lg:my-4\"><a aria-label=\"Read Now: Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers\" class=\"block overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] no-underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[#4169E1] focus-visible:ring-offset-2 flex flex-col md:hidden\" href=\"https:\/\/news.bitcoin.com\/dont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers\/\"><\/p>\n<div class=\"relative aspect-video w-full overflow-hidden rounded-[15px]\"><\/p>\n<h3 class=\"absolute inset-x-0 bottom-0 m-0 p-3 text-xl font-bold capitalize leading-[1.17] tracking-[-0.4px] !text-white\">Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers<\/h3>\n<\/div>\n<div class=\"flex flex-col gap-2.5 px-1 pt-2.5 pb-1\">\n<p class=\"m-0 line-clamp-2 text-xs leading-[1.3] !text-[#67656E]\">This week, the co-founder of Refi Hub, Numa Lunah, explained that he was compromised by following a download link delivered\u2026<\/p>\n<p><span aria-hidden=\"true\" class=\"flex items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white h-[38px] w-full\">Read Now<\/span><\/div>\n<p><\/a><a aria-label=\"Read Now: Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers\" class=\"block overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] no-underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[#4169E1] focus-visible:ring-offset-2 hidden md:flex md:flex-row md:gap-3 lg:hidden\" href=\"https:\/\/news.bitcoin.com\/dont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers\/\"><\/p>\n<div class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\"><img alt=\"Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<\/div>\n<div class=\"flex min-w-0 flex-1 flex-col justify-between gap-2\">\n<h3 class=\"m-0 line-clamp-3 text-xl font-bold capitalize leading-[1.17] tracking-[-0.4px] !text-[#1C1C1C]\">Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers<\/h3>\n<p class=\"m-0 line-clamp-2 text-sm leading-[1.3] !text-[#67656E]\">This week, the co-founder of Refi Hub, Numa Lunah, explained that he was compromised by following a download link delivered\u2026<\/p>\n<p><span aria-hidden=\"true\" class=\"flex items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white h-[38px] w-full\">Read Now<\/span><\/div>\n<p><\/a><a aria-label=\"Read Now: Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers\" class=\"block overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] no-underline focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-[#4169E1] focus-visible:ring-offset-2 hidden lg:flex lg:flex-row lg:gap-4\" href=\"https:\/\/news.bitcoin.com\/dont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers\/\"><\/p>\n<div class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\"><img alt=\"Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F08%2Fdont-trust-verify-poisoned-ai-links-expose-a-nightmare-for-crypto-workers-150x150.png&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img alt=\"Bitcoin.com News\" loading=\"lazy\" width=\"28\" height=\"28\" decoding=\"async\" data-nimg=\"1\" class=\"size-7\" style=\"color:transparent\" srcset=\"\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=32&amp;q=75 1x, \/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75 2x\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=%2Fimages%2Fuploads%2Fbitcoin_news_newlogo.svg&amp;w=64&amp;q=75\"\/><\/div>\n<\/div>\n<div class=\"flex min-w-0 flex-1 flex-col justify-center gap-2\">\n<p><h3 class=\"m-0 min-w-0 flex-1 line-clamp-2 text-2xl font-bold capitalize leading-[1.17] tracking-[-0.48px] !text-[#1C1C1C]\">Don\u2019t Trust, Verify: Poisoned AI Links Expose a Nightmare for Crypto Workers<\/h3>\n<p><span aria-hidden=\"true\" class=\"flex items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white h-12 w-[180px] shrink-0\">Read Now<\/span><\/p>\n<p class=\"m-0 line-clamp-2 text-base leading-[1.3] !text-[#67656E]\">This week, the co-founder of Refi Hub, Numa Lunah, explained that he was compromised by following a download link delivered\u2026<\/p>\n<\/div>\n<p><\/a><\/div>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/dont-fall-for-btc-stealing-fake-claude-apps-as-fable-5-1-and-mythos-5-1-released\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Fake Claude desktop app is already being used to spread the Revstealer infostealer targeting crypto asset wallets. The malware steals encrypted wallet files, browser data, password managers, and VPN configurations without decrypting wallets itself. Newly released Fable 5.1 and Mythos 5.1 could become attractive bait for [&hellip;]<\/p>\n","protected":false},"author":3947362405,"featured_media":77652,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77651"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362405"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=77651"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77651\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/77652"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=77651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=77651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=77651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}