WARNING: New Malware Campaign Targets Claude AI Users To Hijack Accounts

Anthropic is warning Claude users that commodity information-stealing malware is being used to hijack authenticated AI sessions, allowing attackers to take over accounts, consume victims’ usage allowances and potentially trigger unauthorized charges without necessarily needing their passwords or two-factor authentication codes.

Anthropic has begun notifying affected Claude customers after discovering that threat actors are extracting active login sessions from malware-infected computers and replaying those sessions to gain unauthorized access to accounts.

The campaign highlights an increasingly important security problem surrounding generative AI platforms: authenticated AI sessions are becoming valuable credentials in their own right.

According to notifications sent by Anthropic to affected customers, the company recently became aware of a threat actor using common information-stealing malware to collect active Claude login sessions from compromised endpoints. The stolen sessions were subsequently used to access victims’ Claude accounts and consume their available usage.

Anthropic has responded by terminating affected sessions, removing stored payment methods from compromised accounts and refunding charges it determines were unauthorized.

The company has stressed that the infections do not appear to originate from Claude itself. Instead, the affected computers were already infected with general-purpose credential-stealing malware capable of harvesting browser cookies, saved passwords and application credentials.

That distinction is significant. The incident does not currently appear to represent a breach of Anthropic’s infrastructure or a vulnerability allowing attackers to compromise Claude remotely.

Instead, attackers appear to be exploiting something far more widespread: compromised user endpoints containing valid authenticated sessions.

Attackers Are Stealing the Session, Not Necessarily the Password

Traditional account-takeover attacks frequently focus on obtaining a username and password before attempting to defeat or circumvent multifactor authentication.

Session theft changes that equation.

When users successfully authenticate to an online service, the service typically establishes an authenticated session represented by cookies, tokens or other credentials stored on the device. Those artifacts allow users to remain signed in without repeatedly entering their password and completing MFA challenges.

If malware can steal those artifacts, an attacker may be able to reproduce the authenticated state from another environment.

In other words, the attacker may not need to know the victim’s password or obtain their current MFA code because the victim has already completed the authentication process.

The Claude campaign involves precisely this type of threat: infostealers can copy authenticated browser sessions, potentially allowing attackers to bypass the normal password-and-MFA login process.

This technique is not unique to AI services. Session-cookie and token theft has become an important mechanism for compromising email accounts, cloud platforms, developer environments and other web services.

Claude’s increasing integration into professional workflows, however, gives attackers another potentially valuable target.

Vidar, Lumma, StealC and RedLine Among Malware Linked to Compromised Systems

Anthropic’s investigation has identified several well-known information stealers on affected Windows computers.

They include Vidar, LummaC2, StealC, RedLine and Acreed , while a smaller number of compromised macOS systems were reportedly infected with Atomic Stealer , also commonly known as AMOS.

These malware families belong to a broad criminal ecosystem built around stealing information from infected endpoints.

Rather than focusing exclusively on one account or application, information stealers typically attempt to collect as much valuable authentication material as possible from a compromised computer.

That can include browser passwords, cookies, session tokens, autofill information, application credentials and other locally accessible secrets.

Anthropic believes Claude sessions were therefore only one category of credential contained within much larger collections of stolen information.

The attackers apparently began identifying Claude authentication material inside those collections and selectively exploiting it.

That distinction also means users receiving an Anthropic warning should not assume that Claude is the only account potentially compromised.

If an infostealer successfully harvested an authenticated Claude session, other browser sessions and credentials accessible from the same machine may also have been exposed.

Pirated Software Remains a Major Infostealer Delivery Mechanism

In at least one publicly reported case, the affected Claude user acknowledged downloading a pirated game before the compromise was discovered. Cracked software, pirated games, fake installers and malicious applications remain common distribution mechanisms for information-stealing malware.

The strategy is effective because the victim frequently launches the malicious executable voluntarily.

AI developer tools themselves have also increasingly been used as bait.

Earlier this year, Malwarebytes documented campaigns using convincing fake Claude Code installation pages. Attackers reproduced legitimate-looking installation instructions but replaced the genuine command with one that installed information-stealing malware.

The campaign targeted both Windows and macOS systems and demonstrated how criminals can exploit growing interest in AI development tools to compromise technically sophisticated users.

Such campaigns create an important distinction between attacks against an AI platform and attacks impersonating or targeting users of an AI platform .

A fake Claude installer can infect a computer without exploiting any vulnerability in Claude itself.

Likewise, malware already present on a computer can steal an authenticated Claude session even when Anthropic’s service is functioning exactly as designed.

Victims May Notice Their Claude Allowance Suddenly Disappearing

One of the more unusual indicators associated with the campaign is unexpected AI usage.

Anthropic told affected customers that users who noticed their usage allowance apparently replenishing and then rapidly disappearing while they were not actively using Claude may have been victims of the session-hijacking activity.

This occurs because Claude subscriptions impose usage allowances governing how much users can interact with the service during particular periods.

Anthropic explains that usage consumption varies depending on factors including conversation length and complexity, the selected model, features being used and the level of computational effort requested.

Usage across Claude’s different interfaces—including Claude.ai, Claude Desktop and Claude Code—can also count toward the same overall limits.

Consequently, someone controlling a stolen session could potentially consume significant portions of a victim’s allowance without the legitimate user realizing why.

The financial consequences can become more significant where additional paid usage is enabled.

Anthropic allows users on certain paid plans to purchase usage credits that permit continued Claude use after included limits are exhausted. Once enabled, subsequent usage can be charged according to consumption. Users can configure spending preferences and monthly limits.

That explains why Anthropic’s response includes removing stored payment methods from affected accounts.

Anthropic Revokes Sessions and Removes Payment Methods

For accounts it identifies as compromised, Anthropic is taking several defensive measures.

The company is terminating authenticated Claude sessions associated with affected users, removing saved payment information to prevent further purchases and refunding charges identified as unauthorized.

Affected customers may therefore need to authenticate again and re-add their payment method after securing their computers.

But terminating the stolen Claude session addresses only one part of the compromise.

If the underlying infostealer remains installed, newly generated credentials could simply be stolen again after the victim logs back into Claude.

Anthropic explicitly warned customers this problem: signing an account out invalidates the stolen session but does not remove malware from the endpoint.

That makes endpoint remediation essential.

Simply changing a Claude password—or even enabling stronger authentication—may not be sufficient if the compromised machine remains under attacker control.

Why Password Changes Alone May Not Solve the Problem

Session hijacking illustrates one of the limitations of relying exclusively on passwords and MFA as indicators of account security.

MFA provides substantial protection against attackers attempting to authenticate using stolen passwords.

It does not automatically protect an authenticated session that has already been established.

The sequence can effectively look like this:

Legitimate user → Password + MFA → Authenticated session created → Infostealer steals session → Attacker replays session → Claude account accessed

The attacker enters the chain after authentication.

Security controls therefore need to address both initial authentication and what happens to the resulting session.

This is increasingly relevant as browsers and developer environments accumulate credentials for dozens of cloud applications.

A compromised workstation can become a repository containing active access to email, collaboration platforms, source-code repositories, SaaS services, cloud consoles and now high-value AI platforms.

Claude Code Makes AI Credentials Particularly Interesting

The security implications extend beyond ordinary Claude conversations.

Anthropic’s Claude Code product provides AI-assisted development capabilities directly from developer environments and can authenticate through the Anthropic Console or Claude subscription accounts. Anthropic’s documentation states that Claude Code supports authentication through Claude App subscriptions, Anthropic Console accounts and enterprise cloud environments including Amazon Bedrock and Google Vertex AI.

Developer AI credentials can therefore be particularly attractive to attackers.

A compromised AI development environment may sit alongside source code, Git credentials, cloud configuration files, API keys, SSH credentials and access to Model Context Protocol services.

The broader industry has already started examining these risks.

Cloud Security Alliance research published in 2026 warned that stolen refresh tokens from AI developer environments could potentially provide access extending beyond an AI service itself, particularly where development tooling connects with code repositories, infrastructure services and AI-agent workflows.

That makes AI identity increasingly similar to cloud identity.

The question is no longer simply whether an attacker can read someone’s chatbot conversations.

It is whether an AI identity provides access to tools capable of interacting with other systems.

Separate Claude Code Research Shows Why Local Credential Protection Matters

Independent security research has also highlighted the sensitivity of locally stored AI credentials.

In July, Silverfort researchers described a Claude Code credential-storage weakness affecting macOS that they said could allow another process running with the user’s permissions to access stored credentials. The researchers argued that stronger use of macOS Keychain protections could make credential extraction more difficult.

That research is separate from the infostealer campaign now being investigated by Anthropic, and there is no evidence that the two issues are connected.

However, both demonstrate the same broader security principle: once valuable AI authentication material resides on an endpoint, endpoint compromise can potentially become AI-account compromise.

Other Claude Code security research has similarly demonstrated the risks surrounding AI development environments.

Check Point Research disclosed vulnerabilities involving malicious project configurations that could trigger remote code execution or API-token exfiltration through mechanisms including hooks, MCP servers and environment variables. The researchers worked with Anthropic on remediation.

Again, those vulnerabilities are separate from the current campaign.

Collectively, however, the findings illustrate how rapidly the attack surface around AI development tooling is expanding.

AI Accounts Are Becoming Valuable Criminal Commodities

The Claude campaign may also represent an important shift in the economics of credential theft.

Historically, infostealer operators have prioritized credentials that can be immediately monetized: cryptocurrency wallets, banking credentials, email sessions, social-media accounts, cloud accounts and enterprise authentication tokens.

Premium AI accounts now have measurable computational value.

A stolen AI session can effectively provide access to compute that someone else has paid for.

That creates several potential incentives for attackers.

They could consume expensive models without paying for them, automate large volumes of AI requests, use compromised subscriptions as disposable infrastructure or attempt to conceal abusive activity behind legitimate customer accounts.

For developers and organizations, the potential consequences could extend further if compromised AI identities have access to connected tools, repositories or internal information.

There is currently no evidence that Anthropic’s newly disclosed campaign involved all of those activities.

The confirmed activity is narrower: attackers stole authenticated Claude sessions and used them to consume victims’ usage.

But the underlying security model creates a broader concern.

As AI assistants become increasingly agentic—and receive permission to read files, execute code, internal systems or interact with external services—the security value of the identity controlling the agent rises considerably.

Enterprises Should Start Treating AI Sessions as Privileged Credentials

For security teams, the incident provides another reason to include AI services in identity and endpoint-security programs.

Organizations increasingly have employees using AI assistants for programming, research, document analysis and other business functions.

Those accounts should not be treated as isolated consumer applications.

Enterprise defenders should inventory approved AI services, understand where authentication tokens and credentials are stored, restrict unauthorized software installation, monitor infostealer activity and investigate anomalous AI usage alongside other identity telemetry.

Organizations using AI development tools should pay particular attention to developer workstations because these systems frequently contain numerous high-value credentials simultaneously.

A single infostealer infection can therefore create cascading exposure.

Endpoint detection and response systems should be configured to identify known infostealer behaviors, while security teams should consider session revocation—not merely password resets—when investigating infected endpoints.

Where supported, organizations should also establish conservative spending limits for consumption-based AI services.

Unexpected increases in AI usage should be investigated in much the same way organizations investigate unusual cloud-compute expenditure.

What Affected Claude Users Should Do

Users receiving an Anthropic compromise notification should treat the event as an endpoint compromise rather than merely a Claude password compromise .

The infected device should be investigated and cleaned before new credentials are entered.

Other accounts accessed from the same computer should also be considered potentially exposed because general-purpose infostealers typically collect information from multiple applications and browsers rather than targeting a single service.

Users should invalidate active sessions for important accounts, change exposed credentials from a known-clean device and review financial, email, developer and cloud accounts for suspicious activity.

Re-entering credentials on an infected computer risks immediately handing the replacements back to the malware.

Claude users should additionally examine their usage history and billing information for activity they do not recognize.

The Bigger Security Problem: AI Identity Is Becoming a New Attack Surface

Anthropic’s warning is ultimately more than stolen Claude usage.

It demonstrates how established malware ecosystems are adapting to the growing economic value of AI services.

Attackers did not need a sophisticated vulnerability in a frontier AI model. They did not need to compromise Anthropic’s infrastructure or develop Claude-specific malware.

Commodity infostealers already deployed across thousands of compromised endpoints could collect the necessary authentication material.

The attackers merely needed to recognize that Claude sessions were worth stealing.

That is an important development for enterprise security.

For years, defenders have treated browser cookies, cloud tokens and application sessions as valuable credentials because they can provide access beyond the login screen.

AI authentication tokens now belong in the same category.

And as AI assistants evolve from conversational tools into agents capable of writing software, manipulating files, querying enterprise systems and interacting with external applications, compromising the identity behind an AI agent could eventually carry considerably greater consequences than draining a subscription allowance.

For Anthropic customers affected by the current campaign, the immediate threat is unauthorized account access and consumed usage.

For the wider security industry, the warning is more fundamental:

AI accounts have become valuable digital identities—and commodity malware operators have started treating them that way.

Cyber Security Hub

To view or add a , sign in

More articles by The Cyber Security Hub™