Infostealer Malware Hijacks Claude Sessions, Drains User Accounts

• •Infostealer malware is hijacking Claude sessions to drain user accounts.
• •Affected users are being signed out and payment methods removed to prevent unauthorized charges.
• •The malware is not linked to Claude and typically arrives through unofficial downloads.

Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplete usage limits without needing passwords or two-factor authentication. The malware, identified as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on Macs, typically infiltrates systems through unofficial downloads or malicious applications. Affected users are being signed out of their accounts, and saved payment methods are being removed to prevent unauthorized charges. Anthropic has emphasized that the malware is not linked to Claude itself and is urging users to scan their devices for infections. Users have reported unusual account activity, such as usage limits refilling and then rapidly depleting. The company is also issuing refunds for unauthorized charges identified during their investigation.