Vidar is an information-stealing malware-as-a-service that harvests browser credentials, cookies, and crypto wallets from infected Windows systems.
Anthropic is signing affected users out, stripping saved payment methods and issuing refunds after someone began pulling Claude cookies out of ordinary stealer logs and spending other people's quota.
Perspective Coverage
7 publishersReality
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
Zscaler tracked three changes to Vidar's string encryption between early May and early September 2026, ending in a per-build virtual machine and stream cipher that make a key pulled from one sample useless against the next.
Reality
Microsoft Threat Intelligence documents ChatGPT, Copilot, DeepSeek and Claude lures spanning phishing kits, adversary-in-the-middle credential theft, malvertising and fake GitHub installers. A broker it tracks as Storm-3075 resells the access it wins.
Reality
Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.
Reality
The figure comes from a vendor selling stealer-log monitoring, and no methodology is stated, but it lands on the awkward half of the response: containment on hardware the employer does not own, while the session cookie circulates.
Reality
Vidar, LummaC2, RedLine and Atomic Stealer are pulling session material that authenticates without a login prompt, so the usual reset-and-enroll response can leave the intruder inside and spending the victim's paid usage.
Reality
The company told affected customers by email, with nothing on its status page, and the only symptom on the user's side was usage that refilled and drained on its own. Watching that burn is now the account holder's job.
Reality
A Raxis post catalogues three campaigns that made GitHub the delivery host rather than the hiding place, which is why the 1,300 repositories flagged as open to RepoJacking matter more than the million-device headline above them.
Reality
Fake Rockstar pages push a 1.1 MB Vidar sample that takes session cookies as well as saved passwords. Cookies replay past 2FA, which makes this a corporate access problem wearing a consumer costume.
Reality
Google's threat intelligence group says the clusters walk targets through real app-password, OAuth and WhatsApp device-linking flows. The audit log then records consent, not compromise.
Reality