Loading story…
Anthropic warned that information-stealing malware is compromising active Claude sessions, allowing attackers to take over accounts and exhaust victims’ API-token and usage quotas. Reported infostealers include Vidar, Lumma, StealC, RedLine, and Atomic Stealer; the activity primarily affects Windows systems and a limited number of macOS devices, with no reported evidence involving mobile devices. One Claude Max subscriber observed usage increase from 45% to 55% despite having stopped scheduled tasks and not using the service.
Anthropic invalidated affected sessions, reset authorizations, logged out impacted users, removed stored payment details, and said it would refund apparent unauthorized excess-use charges. Users should remove suspicious or pirated software and perform a comprehensive malware scan before regaining access or restoring payment data. Detection may be difficult because Claude’s interface shows aggregate token consumption as a percentage rather than attributing usage to individual tasks; one affected user reportedly waited two weeks for account restoration.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Okta Threat Intelligence published research analyzing a 7 GB infostealer-data dump released on Telegram, identifying unexpired session tokens, JWTs/JWEs, and plaintext API keys affecting Anthropic and multiple other AI-service providers. The analysis described replay of stolen sessions and cited substantial AI-service fraud, including stolen credits and excess usage charges.
Anthropic notified some affected users, terminated suspicious sessions, reset authorization, and logged impacted users out. It removed stored payment details and provided refunds or proportional reimbursements for apparent unauthorized usage; De Swardt's account restoration took two weeks.
UK AI consultant Grant De Swardt observed his Claude Max usage rise from 45% to 55% despite stopping scheduled Cowork tasks and not using the chatbot. Anthropic determined that a compromised session key had enabled third-party access to his account, and other users subsequently reported similar unexplained consumption.
A malicious actor used infostealer malware, including Vidar, Lumma, StealC, RedLine, and Atomic Stealer, to steal Claude credentials and active browser sessions from affected computers. The stolen sessions were used to access accounts and consume victims' Claude token or usage quotas; Anthropic said the malware was not distributed through Claude.
OpenAI identified and banned ChatGPT accounts associated with the Russian-speaking ScopeCreep threat actor, which used the service to develop Windows malware and command-and-control infrastructure. OpenAI also coordinated with the code-hosting provider to remove a trojanized repository impersonating the Crosshair-X gaming overlay; the malware included credential and session theft capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourceheise.de
Open sourceokta.com
Open sourcezdnet.fr
Open sourceopenai.com
Open sourceopenai.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic warned that infostealer malware is stealing active Claude browser sessions from infected devices, allowing attackers to access accounts and consume paid usage without obtaining a password or bypassing multi-factor authentication. The activity has been linked to Windows malware families including **Vidar**, **LummaC2**, **StealC**, **RedLine**, and **Acreed**, with a limited number of cases involving the macOS-focused **Atomic Stealer (AMOS)**. Anthropic is revoking identified compromised sessions, deleting saved payment methods, and refunding confirmed unauthorized charges. The company cautioned that these account-side actions do not remove the underlying malware from affected endpoints; organizations should treat suspicious Claude usage as a potential endpoint compromise, investigate affected devices, and remediate the infostealer infection before users sign in again.
Sep 4, 2026
Threat actors have been using fake crack, keygen, pirated software, and bogus installer sites to infect users with information-stealing malware, often through SEO poisoning, redirect chains, and password-protected archives hosted on legitimate services such as MediaFire, Discord, and filesend.jp. Reported payloads include **RedLine**, **RecordBreaker**, **Cryptbot**, **CopperStealer**, **Lightning Stealer**, **FFDroider**, **ZingoStealer**, **LUMMASTEALER**, and **IDATLOADER**, with lures ranging from KMSpico activators and fake Telegram installers to cracked copies of TeamViewer, VueScan Pro, Movavi Video Editor, and other popular software. Several campaigns used anti-analysis techniques such as anti-VM checks, obfuscated loaders, process hollowing, DLL sideloading, and in-memory execution to evade detection. The malware families stole browser credentials, cookies, credit card data, Discord tokens, Telegram data, screenshots, desktop files, and cryptocurrency wallet information, while some also hijacked clipboard wallet addresses, redirected exchange traffic through malicious proxy settings, abused stolen Facebook and Instagram business accounts, or downloaded follow-on payloads such as miners and additional stealers. Researchers warned that these infections are often opportunistic because victims actively seek pirated software, but the resulting foothold can enable broader compromise, including persistence, backdoor access, VPN abuse, lateral movement, and resale of access to other criminals or ransomware operators.
Aug 15, 2026
Information-stealing malware operators are expanding collection rules to harvest locally stored artifacts from AI-assisted development tools including Claude, Codex, Cursor, Cline, Continue, OpenCode, Gemini, and Kilo. Targeted files can contain account and refresh tokens, API keys, MCP configuration secrets, connected-service credentials, prompt and conversation histories, project metadata, and account details—creating opportunities for account takeover, paid API abuse, intellectual-property exposure, phishing, and fraud. The activity does not exploit a vulnerability in the AI agents; stealers already installed on endpoints are being remotely reconfigured to collect predictable local data stores. Gen Digital observed multiple established stealer families pursuing these artifacts, while BlackFog reported that the MaaS malware **Bee Stealer** v2.1 includes dedicated `.codex` and `.claude` collection paths and advertises theft of associated authentication data and chat histories. Bee Stealer also gathers browser and application data, system information, screenshots, and user files, then uses an "AI PC profile" feature to generate English- and Russian-language victim profiles from stolen logs. Its operator panel supports searching, filtering, tagging, bulk log downloads, and processing stolen Google access tokens, enabling criminals to quickly identify and prioritize high-value victims.
Sep 10, 2026