GoKawiilAnthropic warns Claude self-serve accounts hit by infostealer session-cookie theft
Anthropic notified users that a threat actor used common infostealer malware—including Vidar, LummaC2, StealC, RedLine, Acreed and Atomic Stealer—to steal browser session cookies and replay them into paid Claude accounts, bypassing login and two-factor checks entirely. The company signed out affected sessions, removed stored payment methods, and refunded fraudulent charges tied to the campaign.
GoKawiil's interpretation of the reporting above, not reported fact.
Because these were card-billed, self-serve accounts outside any corporate SSO or admin console, IT teams had no way to detect or revoke access, exposing a blind spot in enterprise AI tool governance. The incident shows that stolen session cookies can defeat 2FA entirely since they represent an already-authenticated session, not a fresh login attempt, making endpoint hygiene as critical as identity controls.
- Session-cookie replay let attackers bypass Claude's login and 2FA protections completely.
- Affected accounts were self-serve, card-billed users with no enterprise identity provider oversight.
- Anthropic mitigated by signing out sessions, removing payment methods, and refunding fraudulent usage.
YubiKey 5C NFC Security Key — When session cookies get stolen, strong phishing-resistant authentication for your accounts is the baseline defense worth having in place. The YubiKey 5C NFC plugs into USB-C or taps via NFC to secure logins across Google, password managers and other services that support hardware keys. It's a simple physical token to keep credentials out of an infostealer's reach.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: venturebeat.com, 2026-09-02
Published there as: “Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.