Claude Session Hijacking: Infostealer Malware Warning

Anthropic is warning Claude users that a wave of infostealer malware running on their own computers has been quietly hijacking active login sessions, replaying them to consume paid usage without the account owner’s knowledge. In response, the company says it is signing out affected sessions, removing saved payment methods to block further charges, and refunding confirmed fraudulent transactions. The disclosure, which circulated on August 30, 2026, is notable less for a single breach than for what it reveals about how attackers are now monetizing stolen AI accounts.

Crucially, Anthropic stresses that the theft did not come through any Claude vector. The compromised machines were infected the old-fashioned way — through pirated software and malicious downloads — and the AI account was simply one of many credentials the malware scooped up along the way.

What Anthropic found

Anthropic says it detected the pattern after noticing an unusual signature in its own telemetry: usage limits being refilled and then drained while the account owners were inactive. Paid Claude plans reset usage allowances on a rolling schedule, and the company observed those allowances being consumed in bursts that didn’t line up with any legitimate user activity — the hallmark of an automated third party replaying a session in the background.

Tracing the behavior back, Anthropic identified a roster of well-known infostealer families on infected machines. On Windows, the named strains include Vidar, LummaC2 (Lumma), StealC, RedLine, and Acreed. On macOS, a smaller number of infections traced to Atomic Stealer (AMOS). These are commodity tools sold on criminal marketplaces, not bespoke malware aimed at Claude — they harvest saved passwords, browser cookies, and locally stored credentials from any application they can reach, then exfiltrate the haul to an operator who resells or exploits it.

The infection vectors were mundane: pirated software downloads and malicious apps, not a flaw in Claude or Anthropic’s infrastructure. The AI account was collateral, swept up alongside whatever else the victim had logged into on the same machine.

Why 2FA didn’t help

The mechanic at the center of this incident is one that trips up even security-conscious users: the malware doesn’t steal your password. It steals your session cookie — the token your browser holds after you’ve already logged in and cleared any second-factor prompt.

Because a valid session cookie represents an already-authenticated session, replaying it bypasses two-factor authentication and single sign-on entirely. The attacker never sees your password, never triggers a login, and never faces a 2FA challenge, because from the server’s perspective the request is coming from a session that already passed all of those checks. This is classic session hijacking, and it is exactly why stolen cookies are such valuable loot: they are a skeleton key that sidesteps the defenses most users assume protect them.

Cookie theft on this scale is also a reminder of why the attributes attached to a cookie — HttpOnly, Secure, SameSite — matter so much. Those flags harden cookies against theft over the network and from malicious scripts, but they offer no protection against malware that has already taken over the operating system and can read the browser’s storage directly. Once an infostealer is running with the user’s privileges, the cookie jar is simply a file it can copy.

What Anthropic is doing about it

Anthropic’s remediation has three parts, each aimed at cutting off a different avenue of abuse:

• Signing out affected sessions. Invalidating the stolen session tokens forces the attacker’s replayed requests to fail. This is the immediate stop-gap.
• Removing stored payment methods. By wiping saved cards from compromised accounts, Anthropic blocks attackers from ringing up further charges or upgrading plans on the victim’s dime.
• Refunding confirmed fraudulent charges. Where unauthorized transactions occurred, the company says it is reversing them.

But Anthropic is blunt about the limits of its own actions. In its guidance, the company warns: “Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware.” That is the essential point. Anthropic can revoke a token, but it cannot clean a machine it doesn’t control. As long as the infostealer keeps running, it will simply capture the next session the moment the user logs back in — and re-harvest every other credential on the device besides.

The practical burden therefore falls on users: the only durable fix is to remove the malware from the affected computer, then rotate credentials and re-authenticate from a known-clean device. Signing back into Claude on a still-infected machine restarts the cycle.

A wider campaign

The session-draining activity is one thread in a broader stretch of Claude-branded abuse. Separately, security firm Huntress reported that at least 29 organizations were compromised over a two-day window tied to a malicious “Claude Desktop” application distributed through search ads. Huntress estimated the malicious artifact was downloaded roughly 7,100 times before it was pulled — a fake desktop client that traded on Claude’s name to lure users into installing the very infostealers now draining accounts.

That pattern — impersonating a trusted AI product to seed malware — echoes the kind of real-world abuse Anthropic itself has been documenting in its cyber evaluations, where the company tracks how its models and brand are targeted or misused in active incidents. The account-draining and the fake-installer campaign are distinct operations, but they share a logic: AI accounts and AI-branded downloads have become attractive targets precisely because they are new, valuable, and not yet wrapped in the security instincts users have built up around banking or email.

Security researchers have also flagged a more insidious persistence trick emerging alongside the commodity theft: poisoned SKILL.md files, the documentation-style configuration files used by agent tooling. In that scenario, attackers disguise malicious instructions as ordinary style-guide notes, so that when an agent loads the tainted file, hidden commands can silently re-fetch an infostealer. If a user reinstalls their operating system but restores the same poisoned config file, the malware can return — a reminder that agent configuration is now part of the attack surface, and that files pulled from untrusted sources deserve the same scrutiny as executable code.

What it means

The headline here isn’t that Claude was breached — it wasn’t. The headline is that AI subscriptions have joined the standard infostealer loot list, sitting alongside crypto wallets, streaming logins, and corporate SSO cookies as things worth stealing off a compromised PC. That is a quiet milestone. It means a paid AI account is now valuable enough on the resale market that automated malware bothers to grab and drain it.

For users, the lesson is uncomfortable but clear: the weakest link is the endpoint, not the provider. No amount of 2FA, SSO, or provider-side hardening protects a session whose cookie has been lifted straight from a compromised machine. The defenses that actually matter here are the unglamorous ones — not installing pirated software, downloading apps only from official sources, keeping endpoint protection current, and treating any unexpected “desktop client” for a web-first product with suspicion. Longer term, this is part of why the industry keeps pushing toward passkeys and hardware-bound credentials: binding a session to a device or a physical key raises the cost of replaying a stolen token from an attacker’s own machine.

For AI providers, the incident is a preview of a maturing threat model. As Anthropic’s own response shows, the useful signal wasn’t a login anomaly — the attackers never logged in — but a usage anomaly: allowances draining while owners were idle. Expect providers to lean harder on that kind of behavioral telemetry, and on shorter-lived, device-bound sessions that make a stolen cookie worth less. Winning users will want stolen sessions to expire fast and stolen cards to be useless; losing ones will keep treating a valid cookie as proof of a valid user.

What to watch next: whether Anthropic and its peers move to tighten session lifetimes and add device binding by default, how quickly the fake-installer campaigns are disrupted at the ad and distribution layer, and whether attackers escalate from draining usage to exfiltrating the far more sensitive conversation history and connected data that a hijacked AI session can also reach. Draining a usage quota is the cheap crime; the account itself may be worth much more.