Overview
- Anthropic disclosed Sunday that attackers used common infostealer malware to copy active Claude browser sessions from infected computers and then access and consume victims’ usage.
- The company has signed affected accounts out, removed stored payment methods, and refunded charges it identified as unauthorized to block ongoing misuse.
- Anthropic identified multiple infostealer families tied to the campaign, including Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer (AMOS) on some Macs.
- Infostealers take saved browser cookies and session IDs so attackers can impersonate logged-in users without entering passwords or bypassing two-factor codes, which is why Anthropic warns cleaning the device is required before re-login.
- Users should scan or wipe infected machines and reset credentials before restoring access, and be wary of unofficial downloads or pirated software since those are common infection routes.