Claude Hijacked via Infostealers: Anthropic Revokes Stolen Sessions, but the Malware Stays on the Machine

> TL;DR: Anthropic has started notifying Claude users that their sessions were stolen by infostealers installed on their machines. The scheme is simple: the malware copies an already-authenticated browser session, and the attacker reuses it to access the account and consume its usage quota. Anthropic identifies Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on a small number of Macs. The vendor's response: force sign-out of compromised sessions, removal of saved payment methods, and refunds of unauthorized charges. Anthropic is explicit that the malware has no link to Claude itself — in the documented case, the infection came from a pirated game downloaded by the user.

The mechanism: the session is worth more than the password

The core technical point deserves understanding beyond this case: an infostealer that copies an authenticated session cookie bypasses the password + 2FA pair entirely. Multi-factor authentication protects login; it does not protect what is already logged in. A developer's or HR member's browser typically holds dozens of active sessions — business SaaS, email, AI tools — and each one is a token reusable as-is.

Anthropic's early-warning signal is telling: "if your usage limits looked like they refilled and then drained while you weren't using Claude." A quota consuming itself is an account being used by someone else — a detection signal that applies to any usage-billed SaaS.

What Anthropic does — and does not do

The vendor applies a three-step response: revoke the stolen sessions, remove registered payment methods to block unauthorized purchases, refund identified fraudulent charges. But Anthropic's warning is honest about the limit: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware. If it's still on your computer, your next login session could be stolen the same way." Treating the symptom server-side does not dispense with treating the cause on the endpoint.

Why this matters to you

Beyond the cost of a drained quota, the real question for teams using AI assistants daily is context. An attacker who takes over a Claude session accesses the account's conversation history: source code pasted for debugging, database excerpts, internal procedures, customer data. Session theft on an AI tool is a passive exfiltration channel — the attacker reads what the tool has already read. And the same infostealer, on the same machine, collects cookies from other SaaS, saved passwords, and local application credentials. On a developer workstation, API keys and environment tokens add to the haul.

What to do

The broader lesson

The security of your AI tools is the security of your endpoints. The whole discussion about enterprise LLM risks (prompt injection, data leakage via API, over-autonomous agents) must not obscure the most mundane vector: an infected machine exporting an already-authenticated session. The measures that matter here are not exotic — developer workstation hygiene, SSO with short sessions, usage anomaly monitoring — but they must explicitly include AI tools in scope, because that is where accessible value (and cost) concentrates for an attacker today.