Commodity infostealers are now cashing out stolen Claude sessions
Anthropic is signing affected users out, stripping saved payment methods and issuing refunds after someone began pulling Claude cookies out of ordinary stealer logs and spending other people's quota.
The Watch · Security desk
What happened
- Anthropic has told some Claude users that infostealer malware on their own PCs lifted active login sessions, which an attacker then used to reach the accounts and consume their usage.
- The company is signing those accounts out, deleting saved payment methods so they cannot be charged, and refunding transactions it identifies as unauthorized.
- Anthropic says the malware arrives through downloads or malicious apps and scrapes locally stored browser passwords, login cookies and credentials belonging to unrelated applications.
- The user who published Anthropic's email on Reddit said their machine was compromised after they downloaded a pirated game.
- Anthropic warns that signing users out kills the stolen sessions but leaves the malware in place, so the next login session can be taken the same way.
Why it matters
- What's now possible capability Sorting stealer logs for AI subscription cookies gives buyers a cash-out that needs no cracking, no phishing kit and no contact with the login page at all.
- What it limits constraint Password rotation and MFA do not evict someone holding a valid cookie, so the only controls that bite are session revocation and getting the malware off the endpoint.
- Who's exposed exposure Because the takeover reached stored payment instruments and not just the quota, the loss ceiling on a hijacked AI account is whatever the card behind it will authorize.
- What it sets up precedent A vendor unilaterally revoking sessions and stripping payment methods on suspicion of client-side compromise sets an expectation other SaaS providers will be measured against.
The only tell Anthropic gave users is a billing curve: limits that refill and then drain while nobody is at the keyboard [3]. Session replay leaves that shape. A cookie sitting in a browser profile is a bearer token, and the password check and the second factor already cleared on the victim's own machine before the theft, so replaying the cookie skips both [4].
Cookie theft is old tradecraft, but the resale value of what gets stolen has shifted. Anthropic's read is that stealer operators collected everything and that a bad actor "has now started picking the Claude sessions out of what it collected and using them" [8]. That is a triage decision inside a log market. The same dump that gets sorted for banking and gaming credentials is now being sorted for metered AI capacity, and the account carries both a quota worth reselling and a card on file, which is why the company pulled saved payment methods rather than only killing the cookies [2].
The toolset here is entirely commodity malware. Anthropic names Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs [5]: six families, five of them on one platform [14]. The company also says it has no reason to believe the malware is related to Claude or was installed through it [6].
The gaps in Anthropic's disclosure matter for scoping the exposure. The record here is Anthropic's own notification email, published by a recipient [15]. There is no number of affected accounts in it and no dates for when sessions were taken or replayed. It also does not say whether the intruder read conversation history or uploaded files; the impacts it addresses are usage, payment instruments and refunds [16]. Anthropic says the investigation is ongoing and that the affected machines were likely already infected with general-purpose stealers before any of this [10].
Order of operations is the operational part. Anthropic tells affected users to change credentials, revoke other sessions and clean the machine [13], and its own caveat explains why sequence decides the outcome: re-authenticating on a dirty endpoint mints a fresh cookie for the same thief [11]. For anyone running these subscriptions inside a company, the identity design has to assume the endpoint is the front door, which puts the weight on short session lifetimes and on a revocation path a helpdesk can trigger without waiting on a vendor ticket.
What to watch
- Whether Anthropic publishes an affected-account count or a window for when sessions were stolen and replayed.
- Whether other metered AI services issue comparable notices, which would show the log market has priced the category rather than one brand.
- Whether Anthropic shortens session lifetimes or binds sessions to a device, rather than relying on post-hoc revocation.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence60
Perspective Coverage
7 publishers- Builder
- Builder 19%
- Operator
- Operator 72%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Anthropic is warning some Claude users that infostealer malware on their PCs stole active Claude login sessions, allowing attackers to access the accounts and consume their usage.
- [2]
Anthropic is signing affected users out of Claude, removing saved payment methods to prevent unauthorized purchases, and refunding charges it identifies as unauthorized.
- [3]
Anthropic told users: "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause."
- [4]
Infostealers can copy an already authenticated browser session, which means the attacker may not need to go through the normal password and 2FA login process again.
- [5]
Anthropic has identified multiple malware families involved, including Vidar, LummaC2, StealC, RedLine and Acreed on Windows, along with Atomic Stealer (AMOS) on a small number of Macs.
- [6]
Anthropic said it has no reason to believe the malware is related to Claude, was installed through Claude, or is related to anything users did with Claude.
- [7]
According to Anthropic, the malware typically arrives through downloads or malicious apps and steals information stored locally, including browser passwords, login cookies and credentials belonging to other apps.
- [8]
Anthropic said: "Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them."
- [9]
The Redditor who shared Anthropic's email confirmed that they had downloaded a pirated game, which explains how their system was compromised.
- [10]
Anthropic says its investigation is ongoing and that the affected computers were likely already infected with general-purpose infostealer malware.
- [11]
Anthropic warned: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way."
- [12]
The warning was delivered in an email Anthropic sent to an affected user who shared it on Reddit; the same email is being sent to other compromised account holders.
- [13]
Anthropic urged affected users to change credentials, revoke other sessions, and remove the malware from their PCs.
- [14]
Anthropic named six malware families in total: five on Windows and one on macOS.
- [15]
The published record of the incident consists of Anthropic's notification email as shared by a recipient, with no independent telemetry or third-party report cited.
- [16]
The reported notice states no number of affected accounts and no dates for when sessions were stolen or replayed, and does not state whether conversation history or uploaded files were accessed; the impacts it addresses are usage consumption, session revocation, payment-method removal and refunds.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comAnthropic warns infostealer malware is hijacking Claude sessions to drain usage
2 articles · August 30, 2026
- helpnetsecurity.comAnthropic locks out Claude users after infostealers hijack login sessions
2 articles · August 31, 2026
- malwarebytes.comInfostealers are hijacking Claude accounts at users’ expense
1 article · September 1, 2026
- scworld.comInfostealer malware compromises Claude accounts, bypassing 2FA
1 article · September 1, 2026
- securityaffairs.comInfostealers Are Hijacking Claude Sessions and Draining Subscriptions
2 articles · August 31, 2026
- securityweek.comAnthropic Warns Claude Users of Infostealer Malware Infections
2 articles · August 31, 2026
- thecyberexpress.comAnthropic Warns Commodity Infostealers Are Hijacking Claude Sessions to Drain Paid Usage
2 articles · August 31, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.