Anthropic Warns Infostealer Malware Is Hijacking Claude Sessions

Anthropic disclosed on August 30, 2026, that infostealer malware running on users' own computers has been stealing active Claude browser session cookies and using them to access accounts and consume paid usage, all without ever needing a password or a second-factor code. The company was clear that this is not a breach of Claude itself: the malware is general-purpose credential-stealing software, typically installed through pirated software, cracked games, or malicious downloads that have nothing to do with Anthropic. But the incident is a useful case study in a threat model that most account-security thinking still underweights: session theft, as distinct from credential theft.

Anthropic

Claude

What Actually Happened

According to Anthropic's notification to affected users, and reporting corroborated across multiple security outlets, threat actors used a cluster of well-known infostealer families to lift Claude session data directly from infected machines. On Windows, the malware families named were Vidar, LummaC2, StealC, RedLine, and Acreed. On macOS, Anthropic identified a smaller number of infections tied to Atomic Stealer, known as AMOS. These are not novel or Claude-specific tools; they are commodity malware kits that have been harvesting browser data, saved passwords, and login cookies from infected PCs and Macs for years, sold and traded on criminal forums as off-the-shelf products.

Once a machine is infected, this class of malware quietly copies whatever is sitting in the browser: saved passwords, autofill data, and critically, session cookies for any site the victim was logged into. Attackers then sorted through that harvested data for Claude sessions specifically and used them to log in as the victim, in some cases racking up unauthorized usage charges on the account's stored payment method.

Why a Stolen Session Beats a Stolen Password

The mechanism here is the part worth understanding, because it explains why this kind of attack routinely defeats defenses that stop ordinary credential theft. A password is a secret you prove you know. Multi-factor authentication adds a second proof, usually something you have or something tied to your device, specifically so that a leaked password alone is not enough. A session cookie is neither of those. It is a token your browser already holds after you have successfully completed both checks, the small file that tells a website "this browser already logged in, do not ask again." Steal the password and MFA still stands in the way. Steal the live session cookie instead, and the authentication has already happened; the attacker is simply presenting proof that it did.

This is why the malware families involved here bypass two-factor authentication entirely, and why "just enable 2FA" is not a complete answer to this specific threat. MFA protects the login event. Session-cookie theft skips the login event altogether and walks in through the door that is already open. The only real defenses are keeping the malware off the device in the first place, since a compromised machine can hand over a freshly authenticated session no matter how strong the login process was, and reducing how long a stolen session stays useful once it exists.

Why AI Accounts Have Become a Target

Infostealers have targeted banking sessions, email, and social media logins for well over a decade. What is newer is the inclusion of AI chatbot accounts in the same harvest, and the economics explain why. A paid AI subscription or API-connected account is not just an inbox to snoop through; it is a line of prepaid or billed compute that can be resold, drained, or used to launder other criminal activity such as running scraping, content generation, or automation at someone else's expense. As usage-based AI billing has become mainstream, a hijacked account with a stored payment method effectively becomes stored value an attacker can spend, with the added benefit that suspicious usage patterns can take longer to notice than a suspicious bank transfer would.

That incentive is likely to grow rather than shrink as more of daily work, from coding to research to routine writing, runs through a persistent AI account rather than a one-off transaction. It is also a reason to think about account exposure differently depending on how much is tied to any single login. A workflow that routes across multiple providers rather than concentrating everything behind one session, the way a model-agnostic platform like Metir AI lets a user reach OpenAI, Anthropic, Google, and xAI models from one place, does not prevent session theft on an infected machine. But it does mean a single compromised login is not automatically the single point of failure for an entire AI-dependent workflow.

Reading the Incident Response

Anthropic's remediation for confirmed-affected accounts followed a fairly standard three-step pattern that is worth naming explicitly, because it maps directly onto the mechanics above. First, the company signed affected users out, invalidating the stolen session tokens so they could no longer be replayed. Second, it removed stored payment methods from those accounts, cutting off the ability to generate further unauthorized charges even if another session were stolen before the user cleaned their machine. Third, it refunded confirmed fraudulent charges. Anthropic also emailed affected users directly and was explicit that signing a session out does not remove the malware causing the problem: if the underlying infection is still active, the next login is just as exposed as the last one.

That sequencing is a reasonable template for any platform responding to session-based compromise, precisely because none of the three steps individually solves the problem. Invalidating sessions stops the specific theft that was caught but not a repeat one from the same infected machine. Removing payment methods limits financial exposure but does not restore account confidentiality on its own. Refunds address the user's financial harm after the fact. Together they buy time and limit damage while leaving the actual fix, malware removal on the user's device, squarely outside the platform's control. That is the structural limit of any provider-side response to an attack that originates entirely on the client.

Practical Defenses

Anthropic's own guidance to affected users, and standard incident-response practice for this malware class more broadly, points to a short list of concrete steps. Scanning for and removing the malware comes first, since nothing downstream matters if the infection is still active. From there: rotate passwords and enable 2FA on the email account tied to any AI or financial login, since email compromise is often the pivot point for further account takeovers; review and revoke saved browser passwords and active sessions across other services, not just the one that was flagged, since infostealers harvest broadly rather than targeting a single site; and check payment card statements for charges beyond the one platform that raised the alarm.

At a platform level, the durable mitigations are shorter session lifetimes that force more frequent re-authentication, device or location anomaly detection that flags a session suddenly presenting from an unfamiliar IP or fingerprint, and the ability to invalidate sessions and strip stored payment data quickly once a compromise is suspected, which is effectively what Anthropic did here. None of these fully close the gap that a compromised endpoint opens, since a sufficiently capable infostealer can, in principle, harvest a freshly issued short-lived session just as easily as a long-lived one. But shorter windows and faster detection reduce how much damage a single theft event can do, which is the more realistic goal than trying to engineer session theft out of existence entirely.

The Broader Pattern

This is not the first time infostealer malware has been reported targeting AI service logins, and the pattern is consistent: it is not a flaw in the AI product, it is a flaw in the security of the device the product is accessed from, and it typically comes bundled with attacks on every other account the same infected machine can reach. That framing matters for how users and platforms alike should think about risk. A malware infection is a total compromise of everything logged into on that machine, not a targeted attack on any one service. Anthropic's disclosure is useful less because it reveals something new about Claude specifically, and more because it is a clear, well-documented illustration of a mechanism, session-cookie theft bypassing MFA, that applies to essentially any account a user logs into from a browser, on any platform, from any AI provider to online banking.

Sources:

• Anthropic warns infostealer malware is hijacking Claude sessions to drain usage | BleepingComputer
• Claude accounts compromised through infostealer | Help Net Security
• Anthropic warns Claude users of infostealer malware infections | SecurityWeek
• Hackers steal Claude login sessions | Cyber Security News
• Infostealers hijacking Claude sessions | The Cyber Express

Image credits

Header image: illustrative stock photograph of a hooded figure at a computer, used as generic imagery for cybercrime and hacking coverage, by Microbiz Mag via Wikimedia Commons, licensed under CC BY 2.0. In-body photograph of handcuffs on a computer keyboard by Klops.ru via Wikimedia Commons, licensed under CC BY-SA 4.0.