Overview
Anthropic has issued direct warnings to affected Claude users after confirming that common infostealer malware is being weaponised to steal authenticated browser sessions and drain victims’ AI usage quotas. The attack does not exploit any vulnerability in Claude itself — rather, it leverages already-compromised endpoints where malware has exfiltrated session cookies, bypassing password and multi-factor authentication entirely. The incident underscores a growing risk: as AI services become routine productivity tools, their session tokens become high-value targets for credential-harvesting operations.
Technical Analysis
Infostealers such as Vidar, LummaC2, StealC, RedLine, and Acreed (Windows) and Atomic Stealer/AMOS (macOS) are designed to exfiltrate browser-stored data including cookies, saved passwords, and authenticated session tokens. Once a Claude session cookie is stolen, attackers can replay it against Anthropic’s web interface without triggering standard login controls. Because the session is already authenticated, 2FA is not prompted, granting the attacker seamless access to the victim’s account, usage allowance, and any saved payment methods.
In at least one confirmed case, the victim downloaded a pirated game, a well-documented initial access vector for infostealer campaigns. The malware collects broad credential data indiscriminately; threat actors then sift harvested logs specifically for Claude sessions to monetise AI compute access.
The attack chain is straightforward:
- Victim endpoint is compromised via malicious download
- Infostealer exfiltrates browser session cookies including Claude tokens
- Attacker replays the session cookie against Claude’s web interface
- Attacker consumes the victim’s usage limits or accesses billing data
Framework Mapping
MITRE ATLAS:
- AML.T0113 – Steal Web Session Cookie: The primary technique; infostealers harvest authenticated Claude session tokens directly from the browser store.
- AML.T0012 – Valid Accounts: Attackers operate within a legitimate, authenticated session, making detection significantly harder.
- AML.T0114 – AI Service Web Interface: The Claude web interface is the surface through which stolen sessions are abused.
- AML.T0040 – AI Model Inference API Access: Attackers gain functional inference access by impersonating the legitimate account holder.
OWASP LLM Top 10:
- LLM06 – Sensitive Information Disclosure: Stolen sessions expose account data and payment methods.
- LLM04 – Model Denial of Service: Usage quota depletion denies legitimate users access to the service.
Impact Assessment
Affected users face two direct harms: financial exposure through unauthorised charges and service disruption through drained usage limits. Anthropic’s response — revoking sessions, removing payment methods, and issuing refunds — mitigates some damage, but detection lag means users may not notice until quotas are already exhausted. Enterprise users with high-value Claude subscriptions or API credits represent the most attractive targets. The attack is not limited to Claude; any AI service relying on browser session persistence faces the same exposure on compromised endpoints.
Mitigation & Recommendations
- Scan endpoints immediately if you notice unexplained Claude usage spikes; use reputable EDR or anti-malware tooling to check for known infostealer families.
- Revoke all active sessions via Claude’s account settings if compromise is suspected, then rotate passwords.
- Remove saved payment methods from AI service accounts proactively to limit financial exposure.
- Avoid pirated software and unverified downloads, which remain the dominant infostealer delivery vector.
- Monitor usage dashboards for anomalous consumption patterns and configure alerts where available.
- Apply endpoint hardening: restrict browser cookie persistence, consider hardware security keys, and enforce application allowlisting.