Summary
- Anthropic customer notices say attackers are selecting active Claude sessions from data harvested by commodity infostealer malware.
- Stolen authenticated sessions can bypass the need to repeat password and two-factor authentication checks.
- Anthropic says the malware is unrelated to Claude itself and has not disclosed how many customers were affected.
Anthropic is warning some Claude customers that commodity infostealer malware running on their computers has stolen active login sessions and allowed an attacker to consume usage attached to their accounts.
The warning has been delivered directly to affected users rather than through a public Anthropic security advisory. BleepingComputer obtained one of the emails, while SecurityWeek separately reported the notification on 31 August.
Anthropic’s account points away from compromise of Claude’s own infrastructure. The company told affected customers that it had no reason to believe the malware was related to Claude, installed through Claude, or connected to anything users did inside the service.
The affected computers had instead been infected with general-purpose information-stealing malware designed to collect locally stored material including browser passwords, cookies, authentication tokens, and credentials belonging to multiple applications.
Anthropic identified Vidar, LummaC2, StealC, RedLine, and Acreed among the Windows malware associated with affected devices. Atomic Stealer was found on a smaller number of Macs.
The abuse illustrates the security difference between stealing a password and stealing an already authenticated session.
A password and multi-factor authentication are used to establish trust at login. After successful authentication, a web application generally stores a cookie or token that allows subsequent requests to be recognised as belonging to the authenticated account.
If malware steals that session material, an attacker may be able to replay it without performing the normal login process again. Password and two-factor checks can therefore have worked correctly when the legitimate customer signed in, while the attacker later abuses the authenticated state copied from the endpoint.
That is not evidence that multi-factor authentication itself has been broken. It means the point of compromise occurs after authentication, where session material becomes the bearer of trust.
The immediate misuse described by Anthropic also differs from many conventional account takeovers. Rather than changing credentials or making ordinary purchases, attackers have been consuming Claude usage associated with paid accounts.
Some affected users noticed usage allowances refilling and then being depleted while they were not using the service.
Metered AI services create an increasingly tangible form of account value. Authentication can provide access not just to stored information but to paid model capacity and compute usage that an attacker can consume without needing to purchase it directly.
Anthropic says it is signing affected customers out, removing saved payment methods, and refunding charges it identifies as unauthorised.
Revoking sessions addresses the service-side part of the compromise, but it does not remove the malware from the endpoint. If an affected user signs back into Claude while the infostealer is still active, the replacement session could be collected in the same way.
The number of affected customers has not been disclosed. The evidence available publicly is also narrower than a formal central incident report because the underlying Anthropic notice has been obtained through affected customers and specialist reporting.
The mechanism nevertheless reflects a broader identity problem across browser-based services. Authentication programmes often concentrate heavily on passwords and multi-factor authentication, while session cookies and tokens carry the actual trust relationship for hours or days after login.
That becomes increasingly important as AI tools join email, collaboration software, cloud consoles, and other high-value web services inside the same browser environment.
An infostealer on the endpoint does not need to attack every provider independently if it can copy the authenticated sessions those providers have already issued.
Anthropic’s response therefore addresses only one half of the problem. Existing sessions need to be revoked at the service, while the compromised device itself needs to be remediated before new sessions can be trusted.
