Anthropic warns of infostealer attacks hijacking Claude sessions

Anthropic has confirmed that several infostealer malware families can hijack active Claude login sessions, allowing attackers to use paid accounts without credentials. The company detected the activity and has signed affected users out, removed saved payment methods, and is refunding unauthorised charges.

The malware, including Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer on macOS, steals browser cookies and credentials. Anthropic advises users to run a full malware scan, change passwords, and enable two-factor authentication before logging back in.