Anthropic Warns of Infostealer-Driven Claude Session Theft

Introduction

Anthropic has begun warning some Claude users that their accounts were compromised through a route that has nothing to do with a weak password or a phishing link: infostealer malware already sitting on their own computer. According to an August 30, 2026 report by BleepingComputer's Mayank Parmar, Anthropic sent an email to affected users explaining that a bad actor has been stealing active Claude login sessions from infected PCs and using them to access those accounts and consume the victims' usage. The notification, obtained after an affected user shared it on Reddit's r/ClaudeAI, gives a direct look at how a widely deployed class of malware is now being pointed specifically at AI chatbot accounts.

What Happened

Anthropic's email to the affected user states plainly: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage."

The company also gave users a concrete way to recognize whether they had been targeted, noting: "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause." That detail matters because it turns an abstract security notice into something a user can check against their own account history.

Anthropic identified several specific malware families behind the activity: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer (AMOS) affecting a small number of Mac users. All are well-known commodity infostealers that have circulated for years and are not unique to targeting Claude — they are general-purpose credential- and cookie-harvesting tools that a bad actor has apparently started mining specifically for Claude sessions.

Anthropic was careful to separate its own product from the source of the compromise, stating: "We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude." In other words, the infection itself did not originate from anything within the Claude product or website.

How Session Theft Works

The technique described by Anthropic does not rely on stealing a password or defeating two-factor authentication in the traditional sense. Infostealer malware can copy an already-authenticated browser session — the cookies and tokens that keep a user logged in — directly off an infected machine. Because the session is already authenticated, an attacker who obtains it may not need to go through the normal login flow, including password entry and any 2FA challenge, at all.

Anthropic explained that this class of malware typically arrives through downloads or malicious apps unrelated to Claude, and once installed, it steals a broad range of locally stored information: browser passwords, login cookies, and credentials belonging to other applications on the same device. As the company put it, "Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them."

That description points to a two-stage process: broad, indiscriminate credential and cookie harvesting by the malware itself, followed by a separate actor sorting through that stolen data specifically for Claude sessions to exploit. In the case shared on Reddit, the affected user confirmed they had downloaded a pirated game — a common vector for exactly this kind of commodity infostealer — which explains how the malware reached their machine in the first place.

Anthropic's Response

Anthropic's stated remediation for affected accounts covers three actions: signing the affected users out of Claude, removing any saved payment methods on those accounts, and refunding charges it identifies as unauthorized. These steps address the immediate financial and access exposure once Anthropic detects a hijacked session.

At the same time, Anthropic was explicit that its response does not solve the underlying problem on the user's device. The company warned: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware." It followed with a direct caution: "If it's still on your computer, your next login session could be stolen the same way." That means an account sign-out is a mitigation against the specific stolen session an attacker was using, not a fix for the compromised machine that produced it.

Anthropic urged affected users to take their own follow-up security steps: change credentials, revoke other active sessions, and remove the malware from the infected computer. The company also said its investigation into the campaign is ongoing, without providing further detail on scope or duration at the time of the report.

What Users Should Do

For any Claude user, the practical takeaways from this warning extend beyond just the Claude account itself. Since infostealers harvest credentials broadly rather than targeting a single service, a Claude session compromise is a signal that other accounts on the same device — email, banking, other AI tools, social media — may also be exposed.

Anthropic's own guidance mirrors this: the fix is not just about the Claude account, but about clearing the malware from the device and treating every other locally stored credential as potentially exposed too.

Outlook

Anthropic has not disclosed how many accounts were affected by this campaign, the total financial impact of the unauthorized usage, or exactly when the underlying campaign began — the company has so far only confirmed that its investigation is ongoing. It also remains an open question whether any Claude conversation content, as opposed to login access and usage, was read or exfiltrated as part of this activity, and whether Anthropic will introduce additional product-level defenses, such as tighter device binding for sessions, in response.

What is clear from this incident is that infostealer malware, a long-established threat against browsers and conventional web accounts, is now being actively repurposed against AI chatbot subscriptions specifically for their usage value. As AI services increasingly bill by consumption, hijacked sessions become a direct way for attackers to extract value without ever needing a victim's password. Users who rely on Claude, or any similar subscription-based AI service, should treat unexplained changes in usage limits as a potential early warning sign, not just an account quirk.

Editor's Verdict

Anthropic Warns of Infostealer-Driven Claude Session Theft brings real, demonstrable value, though with caveats that deserve weighing.

The strongest case for paying attention: Anthropic proactively emailed affected users with a clear, specific explanation rather than staying silent. That alone raises the bar for what readers should expect in this space. Reinforcing that, concrete remediation on Anthropic's side: signing out stolen sessions, removing saved payment methods, and refunding unauthorized charges — practical value rather than just headline appeal. The broader signal worth registering is straightforward: the attack targets browser session cookies rather than passwords, so it can bypass 2FA entirely once a device is already infected. On the other side of the ledger, one constraint is real rather than a marketing footnote: Anthropic has not disclosed how many accounts were affected or the total financial impact of the unauthorized usage. It should factor into any serious decision. Layered on top of that, signing affected users out stops the immediate stolen session but does not remove the malware itself, leaving the same device vulnerable again — which narrows the set of teams for whom this is an obvious yes.

For Anthropic and Claude users, alignment-focused teams, and developers already invested in the Claude ecosystem, a measured trial makes sense, with clear criteria for when to expand or pull back. For everyone else, the safer posture is to monitor coverage and revisit once the use cases that matter to your team are demonstrated in the wild.