The only tell Anthropic gave users is a billing curve: limits that refill and then drain while nobody is at the keyboard [4]. Session replay leaves that shape. A cookie sitting in a browser profile is a bearer token, and the password check and the second factor already cleared on the victim's own machine before the theft, so replaying the cookie skips both [5].
Cookie theft is old tradecraft, but the resale value of what gets stolen has shifted. Anthropic's read is that stealer operators collected everything and that a bad actor "has now started picking the Claude sessions out of what it collected and using them" [9]. That is a triage decision inside a log market. The same dump that gets sorted for banking and gaming credentials is now being sorted for metered AI capacity, and the account carries both a quota worth reselling and a card on file, which is why the company pulled saved payment methods rather than only killing the cookies [2].
The toolset here is entirely commodity malware. Anthropic names Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs [6]: six families, five of them on one platform [14]. The company also says it has no reason to believe the malware is related to Claude or was installed through it [7].
The gaps in Anthropic's disclosure matter for scoping the exposure. The record here is Anthropic's own notification email, published by a recipient [16]. There is no number of affected accounts in it and no dates for when sessions were taken or replayed. It also does not say whether the intruder read conversation history or uploaded files; the impacts it addresses are usage, payment instruments and refunds [15]. Anthropic says the investigation is ongoing and that the affected machines were likely already infected with general-purpose stealers before any of this [11].
Order of operations is the operational part. Anthropic tells affected users to change credentials, revoke other sessions and clean the machine [13], and its own caveat explains why sequence decides the outcome: re-authenticating on a dirty endpoint mints a fresh cookie for the same thief [12]. For anyone running these subscriptions inside a company, the identity design has to assume the endpoint is the front door, which puts the weight on short session lifetimes and on a revocation path a helpdesk can trigger without waiting on a vendor ticket.
