Identity · 58 days ago
Anthropic warned that infostealer malware on compromised PCs has been stealing active Claude login sessions and using them to access accounts and burn through paid usage. The issue is session theft, not password guessing: the attacker gets a live browser session and can enter Claude as the user without logging in again.
That means the browser token is the asset, not just the password. If the infected machine still holds a valid session, resetting credentials may not end the misuse because the attacker can keep using the already-authenticated session until it expires or is removed.
For anyone running Claude on a managed or personal endpoint, the exposure sits at the device and browser layer rather than inside Anthropic's service. The same pattern applies to other SaaS products that stay signed in in the browser: a local infostealer can turn one infected PC into ongoing metered abuse.
5 sources covering this story
Anthropic Users Hit by Infostealer Attacks, Session Thefts
A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users.
Anthropic cracks down on hijacked user accounts mining AI tokens
Commodity malware steals authenticated sessions, letting thieves freeload on victims' paid usage
Anthropic Warns Claude Users of Infostealer Malware Infections
The AI giant is logging customers out of their accounts and removing payment data to prevent unauthorized Claude usage.
Anthropic locks out Claude users after infostealers hijack login sessions - Help Net Security
Anthropic has started locking users out of their Claude accounts due to login sessions compromised through infostealer malware.
Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage.
Part of the PlainSec briefing for 2026-09-01