Back Feeds.4Sysops

Anthropic signs out Claude users after infostealers steal sessions

Feeds.4Sysops •IT News • August 31, 2026

Anthropic is revoking Claude login sessions after infostealer malware began hijacking authenticated browser sessions and consuming users’ usage limits. Because the stolen sessions are already trusted, attackers can access accounts without passwords or two-factor authentication. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Infostealer Malware Hijacks Claude Sessions, Drains User Accounts Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplete usage limits without needing passwords or two-factor authentication. The malware, identified as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on Macs, typically infiltrates systems through unofficial downloads or malicious applications. Affected users are being signed out of their accounts, and saved payment methods are being removed to prevent unauthorized charges. Anthropic has emphasized that the malware is not linked to Claude itself and is urging users to scan their devices for infections. Users have reported unusual account activity, such as usage limits refilling and then rapidly depleting. The company is also issuing refunds for unauthorized charges identified during their investigation. 37 sources 71

Extracted Entities

Anthropic signs out Claude users after infostealers steal sessions

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (2)