Hackers Are Stealing Claude Sessions and Burning Through Paid AI Usage
- The Mess: Anthropic is warning some Claude users that infostealer malware is stealing active Claude login sessions and handing them to attackers. The hijacked sessions are then being used to access accounts and consume their paid usage without the user’s password or 2FA code.
- The Damage: A stolen authenticated session can bypass the normal login process completely. Attackers can drain usage limits, trigger unauthorized charges and potentially access whatever the compromised Claude account can access.
- The Fix: Remove the infostealer from the infected machine, revoke active Claude sessions, change credentials and check the account for unauthorized usage and payment activity. Logging out alone does not remove the malware.
The password wasn’t cracked.
MFA wasn’t defeated.
The attacker simply stole the session after the user had already logged in.
That’s the ugly part of Anthropic’s latest warning to Claude users.
The Session Became the Password
Infostealers are designed to steal whatever valuable credentials they can find on an infected computer.
Passwords.
Browser cookies.
Authentication tokens.
Saved credentials.
This time, Claude sessions were among the targets.
Anthropic says attackers are taking active Claude login sessions from infected computers and replaying them to access accounts.
The attacker doesn’t need to authenticate again.
The browser already did that.
The stolen session effectively tells Claude:
This user is already authenticated.
MFA Doesn’t Save a Stolen Session
This is where users often misunderstand the protection provided by MFA.
Two-factor authentication is extremely useful during login.
But if malware steals an already-authenticated browser session, the attacker may not need to perform the login process at all.
No password.
No authenticator code.
No SMS.
No new authentication prompt.
Just the stolen session.
That makes session theft particularly nasty because the attacker is abusing a legitimate authentication artifact rather than trying to defeat the authentication system itself.
Attackers Are Burning the Victim’s Usage
Anthropic says affected users may notice something strange:
Their usage limit appears to refill.
Then it disappears again.
While they aren’t using Claude.
That’s one of the indicators the company associated with the stolen sessions.
The attackers aren’t necessarily trying to steal money directly.
They can use the victim’s account and its paid capacity for their own purposes.
For a developer using Claude heavily, that can mean burning through expensive usage surprisingly quickly.
Anthropic has also been removing saved payment methods from affected accounts and refunding charges it identifies as unauthorized.
The Malware Isn’t Claude Malware
Anthropic is very clear about one important point.
The malware isn’t being installed by Claude.
The company says it has no reason to believe the malware is related to Claude or installed through Claude.
These are commodity infostealers.
Anthropic identified several families on affected systems, including:
- Vidar
- LummaC2
- StealC
- RedLine
- Acreed
- Atomic Stealer / AMOS on a small number of Macs
These malware families already exist.
Claude is simply another valuable session sitting inside the browser.
One Infection Can Mean More Than Claude
This is the part users shouldn’t overlook.
If an infostealer has already stolen your Claude session, what else did it steal?
Your Google session?
GitHub?
Microsoft 365?
Slack?
AWS?
Password-manager data?
Developer credentials?
API keys?
Claude may be the visible symptom.
The actual compromise can be much larger.
Anthropic itself warns that signing the user out stops the stolen Claude session, but doesn’t remove the malware. If the machine remains infected, a new Claude session can simply be stolen again.
Anthropic Is Forcing Logouts
Anthropic has been responding by signing affected users out of Claude and removing saved payment methods.
The company is also refunding unauthorized charges it identifies.
That’s useful.
But it doesn’t clean the endpoint.
The browser is only where the stolen session lived.
The infostealer is somewhere else on the machine.
That distinction matters.
How the Infection Gets There
Commodity infostealers commonly arrive through malicious downloads, cracked software, fake applications and other social-engineering routes.
In one case reported alongside the Anthropic investigation, the affected user said the infection followed a pirated game download.
The exact delivery mechanism isn’t particularly important.
Once the malware executes, it looks for valuable data.
Claude sessions are simply another prize.
The Bigger Problem Is Session Theft
For years, security advice focused heavily on protecting passwords.
Use a strong password.
Use MFA.
Don’t reuse credentials.
All good advice.
But the browser can hold something just as useful to an attacker:
the proof that you’ve already authenticated.
Steal that proof and the password may become irrelevant.
That’s why modern endpoint security increasingly has to protect browser sessions, cookies and tokens — not just passwords.
Bugstoday Opinion
This isn’t a Claude vulnerability.
That’s almost what makes it more interesting.
There was no spectacular RCE.
No zero-day.
No authentication bypass in Anthropic’s infrastructure.
Attackers infected ordinary computers and stole something the browser had already been trusted to keep.
Then they walked into Claude through the front door.
The same technique can potentially target almost every major web service a user accesses from that machine.
Bugstoday verdict: MFA is not a magic shield against session theft. If an infostealer owns your browser, your authenticated sessions are already part of the loot. Kill the malware first — then log back in.
Today’s Bugs. Tomorrow’s Breaches.
