Loading story…
Anthropic warned that infostealer malware is stealing active Claude browser sessions from infected devices, allowing attackers to access accounts and consume paid usage without obtaining a password or bypassing multi-factor authentication. The activity has been linked to Windows malware families including Vidar, LummaC2, StealC, RedLine, and Acreed, with a limited number of cases involving the macOS-focused Atomic Stealer (AMOS).
Anthropic is revoking identified compromised sessions, deleting saved payment methods, and refunding confirmed unauthorized charges. The company cautioned that these account-side actions do not remove the underlying malware from affected endpoints; organizations should treat suspicious Claude usage as a potential endpoint compromise, investigate affected devices, and remediate the infostealer infection before users sign in again.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Between July 21 and July 22, 2026, Bing sponsored ads directed users seeking the Claude desktop app to a malicious Claude Artifact that delivered a trojanized ClaudeDesktop.exe installer and SectopRAT via DLL sideloading. Huntress reported at least 29 organizations were compromised; the Artifact received roughly 7,100 downloads before Anthropic removed it.
Anthropic began signing affected users out to invalidate stolen sessions, removing saved payment methods, and refunding identified unauthorized charges. It advised affected users to remove malware, change credentials, and revoke other active sessions because newly created sessions could also be stolen.
Anthropic warned that attackers are stealing authenticated Claude browser sessions from infected devices, allowing use of victims' accounts and usage allowances without their passwords or MFA. The company identified Vidar, LummaC2, StealC, RedLine, Acreed, and, on a small number of Macs, Atomic Stealer (AMOS) in affected cases.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
11 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcexakep.ru
Open sourcesecurityweek.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcemeetcyber.net
Open sourcebleepingcomputer.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new macOS infostealer, **AmnesiaStealer**, being spread through **ClickFix-style** social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems. Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, `stream_module`, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the **Aeza Group**, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Aug 24, 2026
Attackers are targeting macOS users with fake AI tool downloads promoted through **Google Ads** and public **Claude.ai** shared chats. Victims searching for terms such as “Claude mac download” are shown sponsored results that appear to reference the legitimate `claude.ai` domain, but the links redirect to shared chats containing bogus installation instructions. The lures present themselves as official guidance for running Claude-related tools on Mac, sometimes even masquerading as Apple Support content, and tell users to paste commands into Terminal that instead fetch and execute malware. Researchers said the campaign is active and uses rotating malicious chat pages and infrastructure to evade disruption. Observed payloads include Mac-focused infostealers with behavior consistent with **AMOS** and **Amatera/MacSync-style** theft, including collection of browser credentials, cookies, and **Keychain** data. The activity reflects a broader trend of threat actors disguising malware as AI agents and developer tools to exploit demand for generative AI software on macOS systems.
Jun 29, 2026
Push Security reported an **“InstallFix” malvertising campaign** targeting developers searching for Anthropic’s *Claude Code* CLI. Attackers clone the legitimate installation page on lookalike domains and buy **Google Search ads** so the fake pages rank highly for queries like “install Claude Code” and “Claude Code CLI.” While links on the page route to Anthropic’s real site, the **copy‑paste install one‑liners** are replaced with malicious commands that fetch malware from attacker-controlled infrastructure; the Windows flow was observed delivering the **Amatera Stealer**, with macOS users likely targeted by similar info-stealing malware. Separately, a reported operational incident highlighted the risk of delegating privileged infrastructure actions to AI agents without strong guardrails: a developer described using *Claude Code* to run **Terraform** changes during an AWS migration and, after a missing Terraform state file led to duplicate resources, subsequent cleanup actions resulted in the **deletion of production components**, including a database and recovery snapshots—wiping roughly **2.5 years of records**. Together, the reports underscore two distinct but compounding risks around AI coding agents: **supply-chain style social engineering** via fake install instructions and **high-impact misexecution** when AI-driven automation is allowed to operate with destructive permissions in production environments.
Jul 8, 2026