Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Infostealer malware hijacks Claude AI sessions, draining user accounts and usage.
Anthropic is warning users that infostealer malware on their PCs is stealing active Claude login sessions. Attackers are using these stolen sessions to access accounts and consume user usage, leading Anthropic to sign affected users out, remove payment methods, and issue refunds. The company stressed that the malware is not related to Claude itself but is a general-purpose threat that collects various credentials, including Claude sessions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Anthropic?
Get an email when a new story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe root cause here is end-user devices compromised by infostealer malware, which harvests active browser sessions and authentication tokens without needing passwords. Attackers exploited the stolen session cookies to impersonate legitimate users and consume paid API or service usage, bypassing traditional credential-based controls entirely. This matters because session token theft circumvents multi-factor authentication, meaning even security-conscious users can be victimized if their endpoint is compromised. Anthropic's response—signing out affected users and removing payment methods—illustrates how platform-side controls can mitigate damage but cannot fully substitute for endpoint hygiene. The incident highlights that credential and session security is only as strong as the weakest device in the chain.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Vidar
- malware — LummaC2
- malware — StealC
- malware — RedLine
- malware — Acreed
- malware — Atomic Stealer (AMOS)