Anthropic is sending warning emails to some Claude users whose computers were infected with infostealer malware. The malware stole their active browser sessions, and a threat actor has been using those stolen sessions to log into their Claude accounts and burn through their usage limits and paid credits — without needing their password or bypassing two-factor authentication.
The attack works because infostealers collect everything the browser has cached on disk: passwords, login cookies, and authentication tokens. A valid Claude session cookie is enough to impersonate the account owner entirely, skipping the normal sign-in flow. Anthropic has identified Vidar, LummaC2, StealC, RedLine, and Acreed on Windows machines, plus Atomic Stealer (AMOS) on a small number of Macs. In at least one confirmed case, the infection arrived via a pirated game download. Anthropic says the malware is not related to Claude itself — users’ computers were already compromised, and Claude sessions were just one of many things the malware swept up. When Anthropic detects a hijacked account, it forcibly signs the user out, removes stored payment methods, and refunds any charges it can attribute to the attacker.
How to check if you’re affected
If your Claude usage limits appeared to refill and then drain while you weren’t actively using the product, your session may have been stolen. Anthropic is contacting affected users directly. Affected products include any Claude plan that stores saved payment methods — Pro, Team, or API accounts. If you suspect compromise: run a reputable anti-malware scanner to remove the infostealer (Anthropic warns that signing out of Claude does not remove the malware — your next session could be stolen the same way), change your Claude password, revoke all active sessions from Account Settings, and check your other saved accounts for signs of unauthorized access, since infostealers harvest credentials from all services stored in your browser.