Anthropic has warned users that infostealer malware is being used to compromise Claude accounts by stealing valid session tokens, enabling attackers to quietly drain API usage and subscription credits. The threat was flagged in a security notice picked up by BleepingComputer, putting a spotlight on a growing category of credential-theft attacks that bypass traditional login protections entirely.
Infostealer malware is designed to harvest credentials, browser cookies, and session tokens from infected machines. In this case, attackers are capturing the tokens that keep Claude users logged in, then replaying those tokens from separate devices to impersonate legitimate users. Because the session appears valid, standard authentication checks do not flag the intrusion. Victims typically discover the attack only after noticing their usage quotas have been exhausted or unusual activity appears in their account logs.
How the Attack Works
Once a device is infected, the malware quietly extracts stored session data from browsers or local application storage. The stolen token is then used to access the victim's Claude account without needing a password or two-factor authentication code. Attackers can run large volumes of queries, potentially using the access for automated content generation, data scraping, or reselling API access to third parties. The victim's account absorbs all associated costs and usage.
Key Facts
- Infostealer malware harvests session tokens, not passwords, making 2FA ineffective as a defense once a token is stolen.
- Attackers use hijacked sessions to run queries and drain usage credits without triggering login alerts.
- Anthropic flagged the threat following observed account abuse patterns consistent with stolen session credentials.
- Users are advised to log out of all sessions and rotate credentials if they suspect device compromise.
- The attack vector is not unique to Claude and has been used against other major platforms and API providers.
This is not the first time Claude-related infrastructure has been in the crosshairs of malware campaigns. Earlier reporting highlighted how fake Anthropic sites were used to target Claude Code users with infostealer payloads, suggesting a sustained and evolving threat landscape around Anthropic's tooling. The consistency of these campaigns points to deliberate targeting rather than opportunistic infection.
Attackers who obtain valid session tokens can interact with Claude exactly as the account holder would, with no indication visible to platform defenses that anything is amiss.BleepingComputer
What Users and Developers Should Do
The most immediate risk falls on individual subscribers and developers with active API keys or browser-based sessions. If a device running Claude, Claude.ai, or related tooling has been compromised by infostealer malware, the attacker gains full functional access. Anthropic recommends reviewing active sessions in account settings, revoking any unrecognized connections, and rotating API keys. Running up-to-date endpoint security software and avoiding downloading tools from unverified sources are also standard precautions.
For developers building on Claude's model family, the advice extends to tightening how API credentials are stored and rotated within deployment environments. Hard-coded or long-lived tokens stored in local browser profiles present the most obvious attack surface for infostealer tooling. Short-lived tokens, environment variable storage, and regular key rotation reduce exposure significantly.
Anthropic has been increasingly vocal about the security risks surrounding AI platforms, including concerns about how AI systems can be weaponized or abused. The company's warnings around session hijacking come alongside broader industry conversations about how rapidly expanding AI API ecosystems create new and sometimes underappreciated attack surfaces. As usage grows across both consumer and enterprise segments, so does the incentive for attackers to find ways to exploit that access.
For now, the practical burden of defense rests largely with users. Keeping devices clean of malware, auditing account activity, and treating AI platform credentials with the same rigor as banking credentials are the clearest steps available. Anthropic has not indicated that its core infrastructure was breached; the attack relies on compromising user devices, not the platform itself.
