Anthropic warns infostealer malware is draining Claude sessions
TL;DR
- Infostealer malware copies authenticated browser session cookies, bypassing 2FA because the stolen token represents an already-logged-in state, not a password.
- The FakeAgent campaign delivered a trojanized ClaudeDesktop.exe via malicious Bing ads on claude.ai, logging 7,100 downloads and compromising at least 29 organizations in two days.
- Poisoned SKILL.md agent configuration files can persist across OS reinstalls, reintroducing malware each time Claude loads tainted skill documentation.
Anthropic told Claude users this week that common infostealer malware has been lifting their authenticated session cookies and running up paid usage on hijacked accounts, according to a customer advisory reported by BleepingComputer.
"We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage," Anthropic said in the notice quoted by the outlet.
The company named Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer (AMOS) affecting a small number of Mac users. The stealers arrive through malicious downloads or apps and pull locally stored browser passwords, login cookies and credentials. Anthropic was explicit that Claude itself was not the vector: "We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude."
For victims, the tell is billing behavior rather than a login prompt. "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause," the notice said. Anthropic said it is revoking the compromised sessions, wiping saved payment methods and refunding unauthorized charges tied to the stolen logins.
None of that closes the hole on the user's own machine. "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware," the company said, telling affected users to change credentials, revoke active sessions and clean their systems. Paid AI usage now sits on the list of assets commodity stealers monetize, one more entry alongside the 246 AI security stories we have logged in the last 90 days on our cybersecurity page.
What others are reporting
-
Cyber Security News Read →
Documents the FakeAgent campaign specifics: 7,100 trojanized ClaudeDesktop.exe downloads, 29 organizations hit, Bing malvertising delivery, and SKILL.md persistence that survives OS reinstalls.
Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication.
-
Help Net Security Read →
Provides concrete remediation sequencing (scan before resetting credentials), full malware variant list across Windows and macOS, and user-experience context via victim Reddit posts.
Session theft is the new credential theft, as it allows attackers to sidestep two-factor authentication.
-
The Cyber Express Read →
Frames the incident as an enterprise governance failure: AI accounts with API keys and repo access sit on unmanaged endpoints outside standard corporate monitoring.
Session cookies represent an already-authenticated state, so an attacker replaying a stolen Claude token steps past both the password and multi-factor authentication entirely.
Originally reported by bleepingcomputer.com
Read the original article →Original headline: Anthropic Warns Vidar, Lumma, StealC and Atomic Stealer Malware Are Draining Claude Session Usage