Infostealer malware already sitting on victims' own computers is stealing active Claude login sessions and using them to drain paid usage, Anthropic has told affected users in email notifications this week, confirmed independently by multiple security outlets. The malware -- commodity families including Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer on macOS -- copies an already-authenticated browser session cookie straight off an infected machine, which lets an attacker into the account without ever entering a password or passing two-factor authentication.
How a stolen session drains an account
- Installed on a victim's computer, typically bundled with pirated software or an unofficial app -- unrelated to Claude itself
- Copies the browser's already-authenticated Claude session cookie off the infected machine
- Replays the stolen session to reach the account without a password or two-factor authentication
- Consumes the account's paid usage limits
- Detects the refill-then-drain usage pattern, signs out the session, removes saved payment methods, and refunds unauthorized charges
Anthropic says it noticed the pattern after some accounts' usage limits appeared to refill and then drain while the account owner was inactive. Its response, according to the notifications: sign out the compromised session, remove any saved payment method from the account, and refund charges it identified as unauthorized.
"Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way." -- Anthropic, in its notification to affected users
Anthropic says it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything a user did inside the product -- the infostealers involved are general-purpose tools that typically arrive bundled with pirated software or an unofficial app, unrelated to the AI service they end up draining. The company has not said publicly how many accounts were affected.
Anthropic's own fix only covers the account side. Security researchers reviewing the incident note that signing a session out or removing a payment method does nothing about the malware still sitting on the infected device -- a freshly created session can be stolen the same way on the very next login. For organizations running Claude at scale rather than individual accounts, the same researchers add a narrower, AI-specific recommendation: sandbox agent environments and audit any `SKILL.md` or similar configuration file for hidden instructions, since a session-hijacking attacker who reaches an agentic setup gets more than a chat log.
- Infostealer malware is stealing active Claude login sessions straight from infected computers.
- The malware copies already-authenticated session cookies, bypassing passwords and two-factor authentication entirely.
- Anthropic has signed out affected sessions, removed saved payment methods, and refunded unauthorized charges.
- Named malware families include Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS.
- Caveat: signing a user out stops the stolen session but does not remove the malware itself.