# Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer

> Anthropic is warning users that Windows/macOS infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) are harvesting authenticated Claude session cookies and replaying them to hijack accounts without needing passwords or MFA, draining usage quotas. A related but distinct malvertising campaign, "FakeAgent," used malicious Bing ads and a public Claude Artifact hosted on claude.ai to distribute a trojanized ClaudeDesktop.exe that DLL-sideloads a VMProtect-packed libcef.dll to deploy the SectopRAT (Arechclient2) .NET RAT, compromising at least 29 organizations in a two-day window.

- **Published:** 2026-08-30T00:00:00Z
- **Last reviewed:** 2026-08-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2249
- **ID:** TL-2026-2249
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Two distinct but related attack chains against Claude users surfaced in August 2026. First, Anthropic identified that commodity infostealer malware families — Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on macOS — are routinely harvesting browser-saved passwords, autofill data, and authenticated session cookies from already-infected endpoints. Because Claude session cookies represent an already-authenticated session, an attacker who copies and replays them gains direct account access without triggering password or MFA/SSO checks. Anthropic detected the abuse via usage-pattern anomalies (usage limits appearing to refill and then drain while the legitimate owner was inactive) and is remediating by force-signing-out affected sessions, stripping saved payment methods, and refunding unauthorized charges — while cautioning that these account-side fixes do not remove the malware from the victim's device, so a fresh session can be stolen again on next login. A newer persistence variant layered on top of this abuses poisoned SKILL.md files (Claude's agent-skill configuration/documentation files): attackers disguise hidden commands as ordinary style-guide notes, and when Claude loads the tainted file it silently re-downloads the infostealer, letting the compromise survive even a full OS reinstall if the tainted file is reintroduced.

Second, and separately, Huntress's SOC identified a malvertising campaign it dubbed "FakeAgent." Victims searching for the Claude desktop app on Bing were redirected through sponsored ads to a malicious public Claude Artifact hosted on the legitimate claude.ai domain, masquerading as an official installer download page. The page accumulated roughly 7,100 views/downloads before Anthropic removed it. The delivered binary, ClaudeDesktop.exe, was actually a repurposed, legitimately signed JetBrains JCEF helper binary (jcef_helper.exe) vulnerable to DLL side-loading; placed alongside it was a tampered, VMProtect-packed libcef.dll that retrieves further C2 configuration data via blockchain transactions on Ethereum/BNB Smart Chain (the "EtherHiding" technique) rather than a fixed domain. A second stage abused a legitimately signed IBM SPSS binary (renamed sslconf.exe) side-loading a malicious tempdir.dll, which decrypts the final SectopRAT payload using a custom AES-256-CTR routine executed via a DirectX SM5 shader on the GPU (evading CPU-based crypto API hooks) and performs anti-VM checks (DXGI adapter vendor ID / VRAM enumeration, shader timing) before establishing persistence via a scheduled task and reaching out to C2 infrastructure. SectopRAT (aka Arechclient2), a .NET RAT active since 2019, harvests browser logins, cookies, autofill data, stored credit cards, Chromium encryption keys, FTP credentials, and Discord/messaging-app data, and can spawn a hidden secondary desktop to manipulate browser sessions directly. Huntress attributed the campaign to a threat actor previously observed running an April 2026 Docker Hub malvertising campaign (fake DockerDesktop.exe) using the identical libcef.dll side-loading tactic, and found the domain-registration email tied to at least 10 malware-distribution domains since December 2025, one of which (polse.us, a StealC host) was seized by Microsoft as part of Operation Endgame.

## MITRE ATT&CK

- T1583.008 Acquire Infrastructure: Malvertising
- T1608.001 Stage Capabilities: Upload Malware
- T1204.002 User Execution: Malicious File
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography

## Sources

- [Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts](https://cybersecuritynews.com/hackers-steal-claude-login-sessions/)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [Anthropic warns infostealer malware is hijacking Claude sessions to drain usage](https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/)
- [Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2](https://gbhackers.com/fake-claude-desktop-installer/)
- [FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations](https://www.itsecurityguru.org/2026/07/23/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations/)
- [FakeAgent Campaign Uses Malicious Bing Ads and Claude.ai Artifacts to Infect Corporate Users](https://cybersecuritynews.com/fakeagent-campaign-malicious-bing-ads/)
- [Anthropic Warns Hackers Are Stealing Claude Sessions To Hijack Accounts](https://www.searchenginejournal.com/anthropic-warns-hackers-are-stealing-claude-sessions-to-hijack-accounts/587566/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2249