Hackers Use Infostealer Malware to Steal Claude Session Cookies and Hijack Accounts

Gbhackers •Divya • August 31, 2026

Anthropic’s Claude AI platform is currently dealing with two separate cybercrime campaigns that aim to steal account credentials, misuse paid subscriptions, and reinstall malware even after a victim believes their device has been cleaned. In response to this threat, Anthropic has started invalidating compromised sessions, removing saved payment methods, and refunding verified fraudulent charges. While […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Infostealer Malware Hijacks Claude Sessions, Drains User Accounts Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplete usage limits without needing passwords or two-factor authentication. The malware, identified as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on Macs, typically infiltrates systems through unofficial downloads or malicious applications. Affected users are being signed out of their accounts, and saved payment methods are being removed to prevent unauthorized charges. Anthropic has emphasized that the malware is not linked to Claude itself and is urging users to scan their devices for infections. Users have reported unusual account activity, such as usage limits refilling and then rapidly depleting. The company is also issuing refunds for unauthorized charges identified during their investigation. 37 sources 71

Extracted Entities

Hackers Use Infostealer Malware to Steal Claude Session Cookies and Hijack Accounts

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Tools (1)