Anthropic Locks Out Claude Users After Commodity Infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijack Login Sessions

Key facts for Vidar LummaC2 Claude session hijack

Detection coverage for Vidar LummaC2 Claude session hijack

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2253 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Pirated/Cracked Installer Execution Consistent With Vidar/Lumma/StealC/RedLine/Acreed Delivery

Detects execution of unsigned, packed binaries launched from Downloads/Temp/user-writable paths shortly after a browser download, and often masquerading as a game crack, keygen, or installer. This is the confirmed initial-access vector Anthropic traced for the infostealer campaign that hijacked Claude session cookies (T1204.002), frequently paired with packed/obfuscated payloads (T1027.002) and filename masquerading (T1036).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1027.002, T1036
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), img=lower(Image)
| where (like(img, "%\\downloads\\%") OR like(img, "%\\appdata\\local\\temp\\%") OR like(img, "%\\appdata\\roaming\\%"))
| where match(img, "(?i)(crack|keygen|patch|loader|setup|activator|repack)\.exe$") OR (Signed="false" AND match(CommandLine, "(?i)(unins|setup|install)"))
| eval is_browser_child=if(match(parent, "(chrome|msedge|firefox|brave|opera)\.exe$"), 1, 0)
| where is_browser_child=1 OR Signed="false"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commandlines by Computer, User, Image, Hashes
| where count > 0
| table Computer, User, Image, Hashes, commandlines, first_seen, last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe")
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where FileName matches regex @"(?i)(crack|keygen|patch|loader|setup|activator|repack)\.exe$" or ProcessCommandLine matches regex @"(?i)(unins|setup|install)"
| where isnotempty(SHA256) and ( InitiatingProcessSignatureStatus != "Valid" or SignatureStatus != "Valid" or isempty(SignatureStatus) )
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| summarize count(), make_set(ProcessCommandLine, 20) by DeviceName, AccountName, FileName, SHA256

Sigma

title: Cracked/Pirated Software Installer Executed From Browser Download Path
id: 7f1c9a2e-3b6d-4e2a-9a1e-2f5b7c8d1a01
status: experimental
description: Detects execution of an unsigned, packed binary matching game-crack/keygen/loader naming conventions launched from a Downloads or Temp folder, spawned by a browser process. This is the confirmed initial-access vector for the Vidar/Lumma/StealC/RedLine/Acreed campaign that hijacked Claude session cookies.
references:
    - https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
    - attack.t1027.002
    - attack.malware.vidar
    - attack.malware.lumma_stealer
    - attack.malware.stealc
    - attack.malware.redline_stealer
    - attack.malware.acreed
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    selection_path:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    selection_name:
        Image|contains:
            - 'crack'
            - 'keygen'
            - 'patch'
            - 'loader'
            - 'activator'
            - 'repack'
    filter_signed:
        Signed: 'true'
    condition: selection_parent and selection_path and selection_name and not filter_signed
falsepositives:
    - Legitimate software activation tools in rare enterprise cases
    - Game modding utilities intentionally allow-listed by the organization
level: high

Known false positives:

• Legitimate unsigned internal tooling launched from a Downloads folder
• Software activation/licensing utilities intentionally allow-listed by IT

Tuning notes: Scope the browser-parent filter to your organization's standard browser set, and allow-list known-good internal packaging/activation tools by hash to reduce noise; widen the Downloads/Temp path list if users redirect these folders.

• 🔒 Sandbox-Evasive Process Launch From Browser-Downloaded Installer · unlock with TL Creds
• 🔒 Browser and System Reconnaissance Followed by Local Data Staging · unlock with TL Creds
• 🔒 Anomalous Claude/Anthropic Usage-Quota Consumption Without Corresponding Interactive Sign-In · unlock with TL Creds
• 🔒 Command-Line Registry Run Key Creation Immediately After Suspicious Installer Execution · unlock with TL Creds
• 🔒 Deobfuscation/Decode Routine in Unsigned Process Preceding Browser Data Access · unlock with TL Creds
• 🔒 Steam/Epic Games API Dead-Drop and Known IOC C2 Beaconing With Web-Protocol Exfiltration · unlock with TL Creds
• 🔒 Browser Cookie/Credential Store Access by Non-Browser Process With Autostart Persistence · unlock with TL Creds
• 🔒 Stolen Claude Session Replay and Dead-Drop C2 Beaconing (Steam/Epic Games API/BNB Chain, Known IOC Infrastructure) · unlock with TL Creds

Indicators of compromise for Vidar LummaC2 Claude session hijack

As of 2026-08-31, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-2253.

How Vidar LummaC2 Claude session hijack works

On 2026-08-29 Anthropic began notifying a subset of Claude users that infostealer malware running on their own computers, not any vulnerability in Claude itself, had stolen active browser session cookies for claude.ai and used them to hijack accounts. Anthropic explained the mechanism plainly: 2FA protects the login event, but once a user authenticates, the site issues a session cookie that keeps the browser signed in; an attacker who exfiltrates and replays that cookie is treated by the application as an already-authenticated user, skipping password and MFA entirely (MITRE T1539 / T1550.004).

Anthropic named the malware families observed in the campaign: on Windows, Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed; on macOS, a small number of cases involving Atomic Stealer (AMOS). All are commodity, malware-as-a-service (MaaS) infostealers sold or rented on Russian-language cybercrime markets, not bespoke tooling built to target Anthropic or Claude specifically. Distribution followed the stealers' typical pattern of unofficial downloads and malicious/pirated applications; Anthropic and press coverage cite at least one affected user who traced their infection to a pirated game downloaded from a Russian-language underground forum.

Because the stolen material is a full authenticated browser session rather than a password, attackers were able to log in as the victim without triggering password-reset or new-device MFA prompts, and used the access to consume the victim's paid Claude usage quota rather than (per Anthropic's public statements) exfiltrating conversation content. Affected users reported usage limits refilling and then draining while they were not using the product themselves — a symptom Anthropic pointed to directly as a hijacking indicator. Some accounts also had unauthorized charges placed against saved payment methods.

Anthropic's incident response consisted of three operational moves: force-invalidating (signing out) all sessions identified as compromised, removing saved payment methods from affected accounts to stop further unauthorized charges, and issuing refunds for charges it identified as unauthorized. Anthropic's guidance to affected users emphasized that revoking the session alone is insufficient — the underlying malware infection must be found and removed, or the same device will simply exfiltrate a fresh session cookie the next time the user logs back in. Recommended remediation also included rotating the email account password (with 2FA enabled), updating any passwords the browser had saved, reviewing card statements, and clearing active sessions on other online services the same device had accessed, since a general-purpose infostealer harvests credentials and cookies for far more than one site at a time.

Acreed's presence on the list is notable in isolation: multiple 2025-2026 threat-intel reports (Bitsight, webz.io) describe Acreed's rapid rise to become one of the leading stealer-log sources on Russian Market and other dark-web marketplaces after a May 2025 law-enforcement disruption of LummaC2's infrastructure displaced Lumma affiliates toward rival services; Acreed research describes it combining C2 channels layered over Steam and the BNB Smart Chain with JSON-based exfiltration and DLL side-loading, and its stolen logs are redistributed through Telegram channels and dark-web stores. This positions the Claude-session campaign as an instance of a much broader, already-tracked commodity infostealer ecosystem rather than a novel or Claude-specific attack technique.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture

Defense Evasion

T1027.002 Software Packing; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Execution

T1059.003 Windows Command Shell

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

execution

T1204.002 Malicious File

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Persistence

T1547.001 Registry Run Keys / Startup Folder

lateral-movement

T1550.004 Web Session Cookie

Impact

T1657 Financial Theft

Remediation for Vidar LummaC2 Claude session hijack

Immediate actions

• Run a full anti-malware/EDR scan on any device used to access Claude before logging back in; do not simply re-authenticate after a forced sign-out
• Treat a forced Claude sign-out or an Anthropic security notice as a signal that the underlying device, not just the account, is compromised
• Rotate the Claude account password and the email account password used for recovery, with 2FA enabled on both
• Update every other password saved in the affected browser, since general-purpose infostealers harvest credentials for all sites, not just Claude
• Review payment card statements for unauthorized Claude (or other SaaS) charges and report them
• Clear/revoke active sessions on other online services accessed from the same device, since the same infostealer run likely stole those cookies too

Workarounds

• Avoid downloading pirated software, cracked games, or unofficial installers, which is the confirmed distribution vector in at least one traced victim case
• Manually revoke browser sessions across all frequently used services after any suspected malware infection, since a platform-side forced sign-out does not remove the malware or prevent a fresh cookie theft on next login

Longer-term hardening

• Treat unofficial downloads, pirated software, and cracked-game installers as a primary infostealer distribution vector and block/flag them at the endpoint
• Deploy EDR detections for browser cookie-store/session-database access by non-browser processes (behavior common to Vidar/Lumma/StealC/RedLine/Acreed/AMOS)
• Shorten session-cookie lifetimes and require step-up re-authentication for high-risk actions (payment method changes, high-volume API/usage spikes) rather than relying on login-time MFA alone
• Monitor for anomalous usage/credit consumption patterns (quota refilling/draining without corresponding user activity) as a session-hijacking indicator
• Consider binding session cookies to device/browser fingerprint or IP-range where feasible to reduce the value of a replayed stolen cookie

Affected and fixed versions

• Anthropic — Claude (claude.ai account login sessions)
  Vulnerable versions: N/A - authentication/session-cookie design pattern, not a specific software version
  Fixed in: N/A - mitigated operationally via mass session invalidation, payment-method removal, and refunds; no product patch issued

Timeline of Vidar LummaC2 Claude session hijack

• 2025-05-01 Law-enforcement action disrupted LummaC2's infrastructure in May 2025, displacing Lumma affiliates and reshaping the commodity infostealer market that later produced the malware families named in this campaign.
• 2025-06-01 Following the LummaC2 disruption, locked-ioc-10 stealer logs on prominent Russian dark-web markets surged past 118,000 by June 2025, establishing locked-ioc-10 as one of the dominant stealer-as-a-service families later observed hijacking Claude sessions.
• 2026-08-29 locked-ioc-7 removed saved payment methods from affected accounts and began refunding charges it identified as unauthorized.
• 2026-08-29 locked-ioc-7 force-signed-out affected accounts to invalidate the hijacked sessions.
• 2026-08-29 locked-ioc-7 began notifying affected users and disclosed that infostealer malware had stolen and replayed Claude browser session cookies to hijack accounts, bypassing 2FA.
• 2026-08-30 BleepingComputer reported the incident, detailing that hijacked sessions were primarily used to drain paid usage quotas and quoting locked-ioc-7's usage-refill/drain symptom description.
• 2026-08-31 Press coverage documented at least one affected user tracing their infection to a pirated game downloaded from a locked-ioc-1, illustrating the campaign's commodity, non-targeted distribution vector.
• 2026-08-31 Help Net Security published detailed coverage naming the specific malware families (locked-ioc-11, LummaC2, locked-ioc-9, RedLine, locked-ioc-10, Atomic Stealer/AMOS) and locked-ioc-7's technical explanation of session-cookie-based 2FA bypass.

Sources cited for Vidar LummaC2 Claude session hijack

• RedLine Stealer, Software S1240 MITRE · Research
• Lumma Stealer, Software S1213 MITRE · Research
• Steal Web Session Cookie, Technique T1539 MITRE · Research
• Use Alternate Authentication Material: Web Session Cookie, Sub-technique T1550.004 MITRE · Research
• What is Acreed Infostealer? The Rise of Acreed bitsight.com · Vendor report
• Acreed Infostealer in 2026 - Everything We Know So Far webz.io · Blog
• Anthropic locks out Claude users after infostealers hijack login sessions Help Net Security · News · 2026-08-31
• Anthropic warns infostealer malware is hijacking Claude sessions to drain usage BleepingComputer · News · 2026-08-30
• Infostealers Are Hijacking Claude Sessions and Draining Subscriptions securityaffairs.com · News · 2026-08-31

Threats related to Vidar LummaC2 Claude session hijack

• Commodity Infostealers Hijack Authenticated Claude Sessions to Drain Usage and Payment Methods
• Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
• Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flows

Previous and next in malware

• HexMage Magecart Campaign Uses Ethereum Smart Contracts for Resilient Card-Skimmer C2 Previous report
• Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage Next report

Further reading

• Anthropic AI Misuse Report (Sept 2026) Mapped