Infostealer malware steals active sessions of Claude: 5 malware involved

Infostealer malware steals active Claude sessions: compromised accounts and refunds

Anthropic detected a targeted attack exploiting infostealer malware to steal active Claude sessions, allowing attackers to access accounts and consume remaining credit. The company is revoking compromised sessions, removing saved payment methods, and refunding unauthorized expenses.

Quick Response

Attack Mechanism and Vulnerability

The infostealers identified by Anthropic include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, as well as Atomic Stealer (AMOS) on some Macs. This malware typically arrives through malicious downloads or apps, stealing passwords, login cookies, and credentials for other applications.

Operational Impact and Residual Risks

Revoking compromised sessions blocks unauthorized access but does not remove the malware from the infected system. If the malware persists, subsequent login sessions could also be stolen. Affected users must take immediate measures to remove the malware and protect their accounts.

Prevention and Corrective Measures

Anthropic advises users to change credentials, revoke other sessions, and remove malware from their devices. The company emphasizes that the malware is not linked to Claude or its activities but was introduced through other sources, such as downloading pirated games.

Data Analysis and Simulations

The Blue Report 2026 measures technical defenses through 338 million simulations in customer production environments. The data reveals that prevention scores can hide vulnerabilities that emerge after initial access. Once attackers use valid credentials, the effectiveness of preventive measures significantly decreases.

Account Security Risks

Users must be aware that infostealers can copy already authenticated browser sessions, bypassing standard authentication processes such as passwords and 2FA. This means that even accounts protected by advanced security measures can be compromised if the device is infected.

Next Steps for Users

Affected users must follow Anthropic's instructions to protect their accounts. This includes removing the malware, changing credentials, and revoking all active sessions. Additionally, it is advisable to perform complete security scans to ensure the device is completely clean.

Implications for Business Security

This attack highlights the importance of robust cybersecurity for all companies handling sensitive data. Organizations must implement advanced preventive measures and continuously monitor suspicious activities to protect their customers from similar attacks.

Final Considerations

The incident underscores the need for greater awareness among users regarding the risks associated with downloading unofficial software or using malicious apps. Companies like Anthropic are working to improve security, but user collaboration is essential to prevent such attacks.

Additional Resources

For more information on security measures and to download the Blue Report 2026, users can visit Anthropic's official website.

The infostealer attack on Claude serves as a warning to all users to be vigilant about the security of their devices and accounts. By adopting adequate preventive measures and following the guidelines provided by companies, the risk of account compromise can be significantly reduced.