[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAKKqJsLBC4_2YqLdhFBlOX1wDeOQaO9AceginKgaOUo":3},{"article":4,"iocs":46,"watch_terms":61,"solutions":62,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"f19e0373-54cc-4c36-bee1-ccfbd3fdf6f4","Anthropic warns infostealer malware is hijacking Claude sessions to drain usage","anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage-f14f42","Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. [...]","Anthropic is warning users that infostealer malware on their PCs is stealing active Claude login sessions. Attackers are using these stolen sessions to access accounts and consume user usage, leading Anthropic to sign affected users out, remove payment methods, and issue refunds. The company stressed that the malware is not related to Claude itself but is a general-purpose threat that collects various credentials, including Claude sessions.","Infostealer malware hijacks Claude AI sessions, draining user accounts and usage.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fartificial-intelligence\u002Fanthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F02\u002F13\u002FClaude_chats.jpg","2026-08-30T14:30:25+00:00","2026-08-30T16:00:09.747366+00:00",7,[17,20],{"name":18,"type":19},"Claude","product",{"name":21,"type":22},"Anthropic","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,50,52,54,56,58],{"type":27,"value":48,"context":49},"Vidar","Infostealer malware identified by Anthropic",{"type":27,"value":51,"context":49},"LummaC2",{"type":27,"value":53,"context":49},"StealC",{"type":27,"value":55,"context":49},"RedLine",{"type":27,"value":57,"context":49},"Acreed",{"type":27,"value":59,"context":60},"Atomic Stealer (AMOS)","Infostealer malware identified by Anthropic on Macs",[21,18],{"controls":63,"vendors":145},[64,93,119],{"slug":65,"name":66,"problem":67,"products":68},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":94,"name":95,"problem":96,"products":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":115,"product_name":116,"url":117,"description":118},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,129,137],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":125,"product_name":126,"url":127,"description":128},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"infostealer-malware-hijacks-claude-sessions-via-stolen-credentials","Infostealer Malware Hijacks Claude Sessions via Stolen Credentials","The root cause here is end-user devices compromised by infostealer malware, which harvests active browser sessions and authentication tokens without needing passwords. Attackers exploited the stolen session cookies to impersonate legitimate users and consume paid API or service usage, bypassing traditional credential-based controls entirely. This matters because session token theft circumvents multi-factor authentication, meaning even security-conscious users can be victimized if their endpoint is compromised. Anthropic's response—signing out affected users and removing payment methods—illustrates how platform-side controls can mitigate damage but cannot fully substitute for endpoint hygiene. The incident highlights that credential and session security is only as strong as the weakest device in the chain.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 10 – Malware Defenses","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","NIST SP 800-63B – Session Management and Authenticator Assurance","NIST AC-17 – Remote Access","NIST SI-3 – Malicious Code Protection","NIST IR-4 – Incident Handling","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1555 – Credentials from Password Stores","GDPR Article 32 – Security of Processing (for EU-based users whose data may be exposed)",{}]