Anthropic warns Claude users of malware stealing login sessions and draining usage

Anthropic, a leading artificial intelligence company, has issued a critical warning to users of its AI chatbot, Claude, following reports that infostealer malware is hijacking active login sessions to access accounts and drain usage. The issue came to light after a report by Bleeping Computers revealed that attackers are exploiting stolen browser sessions to bypass traditional security measures such as passwords and two-factor authentication. In response, Anthropic is taking immediate action to protect affected users, including logging them out of their accounts, removing saved payment methods, and issuing refunds for unauthorized charges. The warning comes after an internal investigation by Anthropic uncovered evidence that malicious software is being used to steal authenticated sessions from infected devices. This allows attackers to access Claude accounts without needing to enter passwords or complete two-factor verification. Instead, they can reuse existing, already-verified sessions, making the breach difficult to detect. An email sent to affected users, shared publicly on Reddit, outlined the signs of potential compromise: if a user notices their account’s usage limits refilling and then unexpectedly depleting during periods of inactivity, it may indicate an attack. According to Anthropic, the malware responsible for these attacks is not linked to the company or its products. Rather, it appears to be general-purpose infostealer malware that spreads through malicious downloads or apps. Once installed, such malware collects sensitive information stored on a device, including browser passwords, login cookies, and credentials for various online services. In some cases, users have confirmed that they downloaded pirated software or games prior to the incident, suggesting that the malware may have entered their systems through these means. Several known malware families have been identified as being involved in the attacks. On Windows systems, the malware includes Vidar, LummaC2, StealC, RedLine, and Acreed. A smaller number of Mac users have been affected by Atomic Stealer, also referred to as AMOS. These types of malware are well-known in cybersecurity circles for their ability to exfiltrate data from infected machines, often targeting browsers and online accounts. Anthropic has taken several steps to mitigate the damage caused by the breaches. For users whose accounts have been identified as compromised, the company is logging them out of Claude, invalidating the stolen sessions, and removing any saved payment information from their accounts. Unauthorized charges will be refunded. However, the company emphasized that these actions address the symptoms rather than the root cause of the problem. If the malware remains on a user’s computer, future login attempts could again be vulnerable to theft. To help users secure their accounts, Anthropic has advised them to change their passwords, revoke all active sessions associated with their accounts, and ensure that the malware is completely removed from their devices. The company stressed that users must take responsibility for cleaning their systems, as it cannot perform that task remotely. Cybersecurity experts recommend running comprehensive scans with trusted antivirus tools and ensuring that operating systems and applications are fully updated to prevent further exploitation. The incident highlights the growing threat posed by infostealer malware, which continues to evolve alongside advancements in technology. As more individuals rely on digital platforms for communication, work, and entertainment, the risk of such attacks increases. Anthropic’s response underscores the importance of maintaining robust cybersecurity practices, even for users who believe their systems are secure. The company has not yet disclosed whether it plans to implement additional safeguards against similar threats in the future.