Anthropic warns Claude users that infostealer malware hijacked their login sessions
A stolen browser session walks past passwords and two-factor prompts, which is why cleaning the device matters as much as resetting the account.
Anthropic has notified a group of Claude users that malware running on their own computers stole active login sessions, according to a report published by BleepingComputer on 30 August 2026. The company said the sessions were captured by common infostealer families and then used by attackers to sign in to the affected accounts and consume usage on them.
The notices named several Windows infostealers, including Vidar, LummaC2, StealC, RedLine and Acreed, along with Atomic Stealer on a small number of macOS machines. Anthropic told users it had no reason to believe the malware was related to Claude, delivered through Claude, or connected to anything the users had done with the product. The number of affected accounts was not disclosed.
In response, the company revoked the compromised sessions, signed affected users out, removed saved payment methods and refunded charges it judged to be unauthorised. It advised users to change their credentials, revoke any other sessions and remove the malware from their devices, pointing out that a sign-out stops the stolen session from working but does not clean the machine that leaked it.
The report describes how this class of malware operates: it copies an already authenticated browser session, so an attacker holding that copy may never need to enter a password or pass a two-factor challenge. One affected user traced their infection to a pirated game. The Register followed the story on 31 August, noting that access to paid AI accounts has resale value because usage on those accounts is metered.
Why it matters
Paid AI subscriptions have joined bank logins and cloud consoles on the list of things infostealers harvest. The incident shows the weak point was the endpoint rather than the service, and that a provider can only limit damage after the fact. Session tokens are now the practical currency of account takeover. Expect more providers to invest in session anomaly detection and shorter token lifetimes.
Paid AI subscriptions have joined bank logins and cloud consoles on the list of things infostealers harvest.
Infostealer runs on the victim's PC
Arrives through cracked software, fake installers or malicious downloads and runs with ordinary user rights.
Browser cookie store is copied
The malware decrypts saved cookies and tokens using the logged-in user's own operating system keys.
Log is sold or reused
Harvested sessions are bundled into logs and traded; buyers search them for valuable accounts.
Attacker replays the session
Presenting the copied token counts as an authenticated login, so no password or second factor is requested.
Provider revokes and refunds
The service invalidates sessions and reverses charges, but the malware on the endpoint remains.
What you can learn from this
- Session tokens are bearer credentials. After you log in, a website hands your browser a cookie or token that says a request comes from an authenticated user. Anything that presents that token is treated as you, because the server cannot tell whether the bytes came from your browser or from a copy. That is why a stolen session bypasses both the password and the second factor: those checks happened once, at login, and the token is the receipt. Long-lived tokens widen that window, which is why short lifetimes and re-authentication before sensitive actions are standard defences.
- Infostealers are opportunistic harvesters, not targeted intrusions. Families such as RedLine, Lumma and Vidar are sold as services, spread through cracked software, fake installers and malicious adverts, and run once to scoop up browser databases, saved passwords, cookies and wallet files. The resulting logs are sold in bulk, and buyers search them for whatever is valuable that month. A metered AI subscription is attractive because its usage can be resold or burned through quickly before anyone notices.
- Revoking a session and removing malware are separate remediation steps. A provider can invalidate tokens on its side, which cuts off the attacker immediately. But the malware that produced the log is still on the endpoint and will simply harvest the new session after the next login. Complete remediation means cleaning or reimaging the device first, then rotating every credential that was stored on it. Rotating a password before the device is clean simply hands the attacker the new password.
- Browser credential stores are a soft target by design. Browsers encrypt saved passwords and cookies with keys tied to the logged-in operating system user, so any program running as that user can ask the system to decrypt them. This convenience is what makes autofill work, and it is also why malware with ordinary user rights can read everything. Some browsers have added app-bound encryption to raise the bar, but the underlying trade-off between convenience and isolation remains.
- Detection often comes from the service, not the victim. Providers see logins from unusual locations, devices or usage patterns that the account owner never notices, which is how abuse of this kind tends to surface. That is why anomaly detection, impossible-travel checks and spending alerts matter for any service that meters consumption. Services that meter usage can also spot a sudden spike in consumption that does not match the account's history. The victim's first sign of trouble is frequently an email from the provider.
We teach this
How to use this in practice
- Audit the active sessions on the accounts that matter. Open the security settings on your AI provider, email, cloud console and password manager and find the page listing sessions or signed-in devices. Sign out every session you do not recognise, and sign out all other sessions if the list is confusing. While you are there, turn on new-login notifications so a fresh session triggers an email. Done looks like: each account shows only the devices you are sitting at right now.
- Run a full scan and check for persistence. On Windows, run a full scan with Microsoft Defender or your chosen tool, then list startup entries with
Get-CimInstance Win32_StartupCommandin PowerShell and review Task Scheduler for unfamiliar tasks. On macOS, list~/Library/LaunchAgentsand/Library/LaunchDaemonsand look for entries you did not install. If something looks wrong and you cannot explain it, treat the machine as compromised and reinstall rather than trying to remove the malware by hand. Done looks like: a clean scan plus a startup list where you can name the purpose of every entry. - Raise the cost of a stolen browser profile. Move saved passwords out of the browser into a dedicated password manager that requires unlocking, turn off browser password saving, and enable whatever app-bound or keychain protection your browser offers. Then set a spending cap or usage alert on any metered AI or cloud account so abuse becomes visible within hours rather than at the end of a billing cycle. Check whether the provider offers passkeys and enrol one, so the login itself no longer depends on a password stored anywhere on disk. Done looks like: an empty browser password list and a cap or alert configured on each metered account.
- Draw the attack path on one page. Sketch the chain: pirated download, infostealer runs as the user, browser cookie database decrypted, log uploaded, buyer replays the session, usage consumed, provider revokes. Mark where each control, such as a download policy, endpoint protection, app-bound encryption, session anomaly detection or spending caps, would have interrupted the chain. Done looks like: a diagram with at least three named controls placed on specific arrows.
Sources
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage — BleepingComputer
- Anthropic cracks down on hijacked user accounts mining AI tokens — The Register
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report