Back Feeds.Feedburner

Anthropic Warns Claude Users of Infostealer Malware Infections

Feeds.Feedburner •Eduard Kovacs • August 31, 2026

Anthropic has warned some Claude users that infostealer malware on their computers allowed attackers to hijack login sessions and run up usage limits, according to an email the company sent to affected customers.

The company said it detected the activity, signed out the compromised sessions, and removed saved payment methods from affected accounts as a precaution.

Anthropic is alerting Claude AI users whose computers were infected with infostealer malware such as Vidar, Lumma, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of macOS devices.

The AI giant emphasized that the malware is general-purpose and not tied to Claude itself, typically arriving via unofficial downloads or malicious apps.

The company said the malware quietly copies saved passwords, browser login cookies, and credentials for other local applications.

Anthropic believes a threat actor subsequently began selecting the stolen Claude sessions out of that harvested data and using them to access accounts. Users who saw their usage limits appear to refill and then drain without actively using Claude were told this was the likely cause.

In response to the campaign, Anthropic signed out the affected sessions and warned it may sign users out again if it observes further signs of account misuse.

The company also said it removed saved payment methods so accounts could not be charged, and users must add a payment method again to renew or make further purchases. Anthropic also noted that it refunded any Claude charges it identified as unauthorized.

Victims of this campaign have been told to only re-add a payment method after ensuring that all malware has been removed from their computers.

Related : Irregular Details How a Naming Error Let AI Models Attack a Real Company

Related : Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’

Related : Conflicting Test Goals Pushed Claude Agents to Deploy Self-Replicating Malware

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Infostealer Malware Hijacks Claude Sessions, Drains User Accounts Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplete usage limits without needing passwords or two-factor authentication. The malware, identified as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on Macs, typically infiltrates systems through unofficial downloads or malicious applications. Affected users are being signed out of their accounts, and saved payment methods are being removed to prevent unauthorized charges. Anthropic has emphasized that the malware is not linked to Claude itself and is urging users to scan their devices for infections. Users have reported unusual account activity, such as usage limits refilling and then rapidly depleting. The company is also issuing refunds for unauthorized charges identified during their investigation. 46 sources 71

Extracted Entities

Anthropic Warns Claude Users of Infostealer Malware Infections

The full story

Extracted Entities

Attack Types (1)

Malware (5)

MITRE ATT&CK (1)

Platforms (2)