Infostealers Are Hijacking Claude Sessions and Draining Subscriptions
Brief
Infostealers can steal active Claude sessions, bypass 2FA and drain paid usage. Anthropic is revoking access and refunding unauthorized charges.
Anthropic confirmed that several infostealer malware can hijack an active Claude login session and let attackers burn through your usage without ever touching your password.
“Our investigation is ongoing. Our findings to date suggest that a computer you use with Claude is likely infected with infostealer malware, and may have been for some time. Phones and tablets do not appear to have been involved.” reads the notification sent to the impacted users.
“We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.