Anthropic told Claude users on August 31, 2026 that infostealer malware sitting on their own computers, not any flaw in Claude itself, had been used to hijack active login sessions and run up charges on their accounts. The company is signing out everyone it flagged, wiping saved payment methods, and refunding charges it identified as unauthorized.
The attack doesn't bother stealing a password. It goes straight for something more useful to an attacker: the cookie your browser already holds that proves you're logged in.
RelatedPaperCut Rushes Emergency Patches After Confirmed Attacks
How does session hijacking bypass two-factor authentication?
Two-factor authentication checks who you are at one specific moment: the login. Type your password, approve a push notification or code, and the server hands your browser a session cookie that says "this device is authenticated, let it through." From that point on, every page load and API call rides on that cookie. Nobody re-checks your password or your 2FA code on each request, because that would make the web unusable.
That design is exactly what session hijacking exploits. If an attacker copies your session cookie off an infected machine and loads it into their own browser, Claude has no way to tell the difference between you and them. The login step already happened. Replaying the cookie is like handing someone your all-access wristband after the ticket scanner already waved you through. Nobody's checking IDs at the bar.
Which malware families are involved?
Security researchers at SecurityWeek, BleepingComputer, Help Net Security and others cross-referenced Anthropic's disclosure and named the same cluster of general-purpose credential stealers behind the campaign:
- Vidar, one of the longest-running infostealer-as-a-service kits on Windows.
- Lumma, widely distributed through cracked software and fake cracks/keygens.
- StealC, a newer stealer favored for its browser-cookie harvesting.
- RedLine, a veteran stealer sold on underground forums for years.
- Acreed, a less widely covered but confirmed Windows-targeting variant.
- Atomic Stealer (AMOS), hitting a small number of macOS devices.
None of these were built to target Claude specifically. They're commodity malware that arrives through unofficial software downloads, cracked apps, or installers bundled with something else the victim actually wanted. Once running, they scoop up whatever a browser has stored: saved passwords, session cookies, and credentials for other local apps. The Claude angle came after that. A threat actor took the harvested data, which likely included logins for dozens of other services too, and specifically dug through it for reusable Claude session cookies.
Who's affected, and how do you check?
The Windows-based families cast a much wider net than the Mac campaign, which Anthropic and researchers describe as touching a small number of AMOS-infected devices. Anthropic says it has already identified the accounts it believes were compromised and is acting on them directly rather than waiting for users to notice something's wrong.
If you use Claude, the honest signal to check for is mundane: did you get signed out of Claude.ai without doing it yourself, did a saved payment method disappear from your billing page, or is there a charge on your card or in your Claude usage history you don't recognize. Any of those is worth a look at your account's login history and a scan of the device you normally use to sign in.
What is Anthropic doing about it?
Three concrete steps: forcing a sign-out on accounts it flagged as compromised, removing saved payment methods on file for those accounts, and issuing refunds for charges it identified as run up without the account owner's permission. That last part matters because the financial motive here wasn't just snooping. Attackers with a hijacked Claude session can burn through paid usage or API credits, which is real money leaving someone's account.
RelatedMetabase Zero-Day Let Attackers Grab Admin, No Login
Anthropic has been careful to frame this as a device-side compromise, not a break-in on its own infrastructure. The malware never touched Anthropic's servers. It sat on a user's laptop, grabbed whatever was in the browser, and an attacker separately went looking for Claude cookies inside that haul.
What should Claude users do right now?
- Run a real anti-malware scan, not just Windows Defender's quick pass, especially if you've installed cracked software, "free" versions of paid tools, or keygens in the past year.
- Change your Claude password even if you weren't flagged, and make sure 2FA is turned on for the login step it does protect.
- Log out of Claude everywhere if your account settings offer that option, which invalidates existing session cookies rather than just changing the password.
- Check your card statement and Claude billing history for anything you don't recognize, and report it if you find something.
- Stop installing software from unofficial sources. This one campaign alone touched five separate malware families that all spread the same way.
What this means for AI platforms beyond Claude
Session cookies aren't a Claude quirk. Every major AI platform runs on the same web login model, ChatGPT, Gemini, Perplexity, all of it. If an infostealer sitting on your machine can grab a Claude session, it can grab those too, and the only reason this story is about Claude right now is that Anthropic is the one who disclosed it. Paid AI accounts are becoming a genuinely attractive target: usage credits and API access can be resold or burned through faster than most people notice.
- More disclosures. Expect OpenAI, Google, and other AI vendors to acknowledge similar hijacking attempts once the pattern gets attention; the infostealer ecosystem doesn't discriminate by platform.
- Device-binding for sessions. Watch for Anthropic and peers rolling out session tokens tied to device fingerprints or shorter expiry windows, which would blunt a stolen cookie's usefulness fast.
- Browser vendors tightening cookie protections. Chrome and Edge have both been building OS-level cookie encryption; expect that work to get cited directly in response to campaigns like this one.
- Infostealer-as-a-service keeps growing. Vidar, Lumma, and StealC are commercial products sold to anyone. As long as that market exists, this kind of downstream account abuse doesn't stop at one platform.
Our take
The uncomfortable part of this story isn't the malware. It's that 2FA, the thing most of us treat as the strong lock on the door, was never designed to stop this and can't. It guards the login, and this attack never logs in. That's not a failure of 2FA so much as a reminder of what it was actually built for.
The real fix isn't a stronger password prompt. It's device hygiene, because once an infostealer is running on your machine, it has access to everything your browser trusts, not just Claude. Anthropic's response here, refunding charges and force-logging out flagged accounts, is the right damage control. But the durable fix has to come from shorter-lived sessions and device-bound tokens on the platform side, paired with people actually not installing cracked software on the machine they do their real work from. Both sides of that equation need to move, and right now only one of them is.
- AdvisoryAnthropic Warns Claude Users of Infostealer Malware Infections : SecurityWeek's writeup of Anthropic's disclosure
- ReportingAnthropic warns infostealer malware is hijacking Claude sessions to drain usage : BleepingComputer on the account-draining mechanism
- AnalysisClaude accounts compromised through infostealer : Help Net Security on scope and response
- ReportingInfostealers are hijacking Claude sessions and draining subscriptions : SecurityAffairs on the malware families involved
GenZTech analysis, built on Anthropic's disclosure as reported by BleepingComputer.