[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frnZI10OhHXb4sypYTGE9Tl97XTMg4n8n_POIWui6BGo":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6fd80507-3991-416b-ac2d-4f789df98024","Anthropic Users Hit by Infostealer Attacks, Session Thefts","anthropic-users-hit-by-infostealer-attacks-session-thefts-b3f570","A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users.","A threat actor has successfully targeted users of Anthropic's AI chatbot, Claude. The attacker employed various infostealer malware strains to pilfer session cookies and credentials, granting them unauthorized access to user accounts. The exact number of affected users remains unknown.","Anthropic users targeted by infostealer attacks leading to session theft.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fanthropic-users-infostealer-attacks-session-thefts","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte57f544bc451abd9\u002F6a95e1e44e3e37aa8ed4fed0\u002Fclaude_Thaspol_Sangsee_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-08-31T21:08:46+00:00","2026-08-31T22:00:20.558953+00:00",7,[17,20],{"name":18,"type":19},"Claude","product",{"name":21,"type":22},"Anthropic","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"infostealer","Malware used to steal session information",[21,18],{"controls":52,"vendors":138},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":83,"name":84,"problem":85,"products":86},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":112,"name":113,"problem":114,"products":115},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[116,123,131],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":120,"url":121,"description":122},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":112,"product_name":135,"url":136,"description":137},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":156},"infostealer-malware-hijacks-claude-ai-user-sessions","Infostealer Malware Hijacks Claude AI User Sessions","Threat actors targeted Anthropic's Claude users by deploying infostealer malware to harvest session cookies and credentials, enabling unauthorized account takeovers without needing passwords. This attack highlights a critical gap in user security hygiene — malware on endpoint devices can bypass even strong authentication by stealing active session tokens directly from browsers. Session cookie theft is particularly dangerous because it sidesteps multi-factor authentication entirely once a valid session is captured. Organizations and individuals using AI platforms for sensitive work must recognize that endpoint compromise directly translates to cloud account compromise. The unknown scale of affected users underscores the lack of visibility many platforms and users have into credential theft events.",[144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 10 – Malware Defenses","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Session Management)","NIST AC-2 – Account Management","NIST SI-3 – Malicious Code Protection","NIST IR-6 – Incident Reporting","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1555 – Credentials from Password Stores",{}]