Anthropic warns that infostealer malware is hijacking Claude sessions and draining usage

Anthropic is warning affected Claude users that commodity infostealer malware has stolen active browser sessions and reused them to access Claude accounts and consume paid usage. The incident is not described as malware distributed by Claude or as a breach of Anthropic itself: the affected computers were already infected with general-purpose credential-stealing malware.\n\nAccording to an Anthropic notice reported by BleepingComputer, the company identified Windows malware families including Vidar, LummaC2, StealC, RedLine and Acreed, plus Atomic Stealer on a smaller number of Macs. Anthropic is signing affected users out, revoking compromised sessions, removing saved payment methods and refunding charges it identifies as unauthorized.\n\nThe security lesson is important for AI accounts because stealing an authenticated browser session can let an attacker bypass the normal login flow. Changing a password or relying on two-factor authentication does not by itself clean an infected device; a newly created session can be stolen again while the infostealer remains present. Anthropic has therefore advised affected users to remove the malware as well as rotate credentials and sessions.\n\nFor Claude users, unexplained usage depletion can be an account-compromise signal rather than a change in Claude quotas. For organizations, the incident is another reason to treat authenticated AI sessions as valuable credentials and to combine endpoint security with session revocation and usage monitoring.