Trojanized 'Claude Opus 5' Electron Installer Execution Chain

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•6

Detects the execution of a malicious Electron-based installer masquerading as Anthropic's Claude AI (ClaudeOpus5-desktop.exe). The rule monitors for the specific filename or known malicious hashes, as well as the spawning of an embedded malicious loader process associated with the RevStealer infection chain.