GoKawiilAnthropic revokes hijacked Claude sessions stolen by infostealer malware
Anthropic has notified a group of Claude users that infostealer malware on their PCs siphoned off active login sessions, letting attackers access their accounts and burn through usage limits. The company is signing out affected accounts, stripping saved payment details, and refunding charges tied to the unauthorized activity while it continues investigating the source.
GoKawiil's interpretation of the reporting above, not reported fact.
Because infostealers can hijack an already-authenticated browser session, attackers can bypass passwords and two-factor authentication entirely, making this kind of theft harder for users to detect than a typical account breach. It also underscores that AI service credentials are becoming a valuable target for malware operators, not just banking or email logins, meaning users need broader endpoint security, not just strong AI account passwords.
- Malware families like Vidar, LummaC2, StealC and RedLine stole Claude session cookies alongside other credentials.
- Victims saw usage limits refill and then mysteriously drain without their involvement.
- Anthropic says the compromise stems from unrelated malware infections, often via pirated downloads, not a Claude vulnerability.
YubiKey 5C NFC Security Key — Session-stealing malware is nasty, but hardware-backed logins make re-authentication far harder for attackers to fake. The YubiKey 5C NFC plugs into USB-C or taps on your phone to lock down accounts with phishing-resistant two-factor, a smart upgrade after any credential scare like this Claude session hijacking.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-30
Published there as: “Anthropic warns infostealer malware is hijacking Claude sessions to drain usage”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.