Infostealers Hijack Claude Browser Sessions to Abuse AI Usage

Anthropic warned that infostealer malware is stealing active Claude browser sessions from infected devices, allowing attackers to access accounts and consume paid usage without obtaining a password or bypassing multi-factor authentication. The activity has been linked to Windows malware families including Vidar, LummaC2, StealC, RedLine, and Acreed, with a limited number of cases involving the macOS-focused Atomic Stealer (AMOS).

Anthropic is revoking identified compromised sessions, deleting saved payment methods, and refunding confirmed unauthorized charges. The company cautioned that these account-side actions do not remove the underlying malware from affected endpoints; organizations should treat suspicious Claude usage as a potential endpoint compromise, investigate affected devices, and remediate the infostealer infection before users sign in again.