# Anthropic Locks Out Claude Users After Commodity Infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijack Login Sessions

> Anthropic disclosed on 2026-08-29 that commodity infostealer malware on users' own devices had been stealing Claude browser session cookies and replaying them to bypass 2FA, letting attackers hijack accounts to drain paid usage quotas. Anthropic responded by force-signing-out affected sessions, removing saved payment methods, and refunding unauthorized charges.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2253
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-vidar-lummac2-claude-session-hijack-tl-2026-2253.webp?v=14968182 (Threadlinqs threat intel: Vidar and LummaC2 Hijack Claude Sessions: Detection & IOCs (TL-2026-2253) — Medium severity, 12 IOCs, 9 detection rules.)
- **ID:** TL-2026-2253
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12

## Description

On 2026-08-29 Anthropic began notifying a subset of Claude users that infostealer malware running on their own computers, not any vulnerability in Claude itself, had stolen active browser session cookies for claude.ai and used them to hijack accounts. Anthropic explained the mechanism plainly: 2FA protects the login event, but once a user authenticates, the site issues a session cookie that keeps the browser signed in; an attacker who exfiltrates and replays that cookie is treated by the application as an already-authenticated user, skipping password and MFA entirely (MITRE T1539 / T1550.004).

Anthropic named the malware families observed in the campaign: on Windows, Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed; on macOS, a small number of cases involving Atomic Stealer (AMOS). All are commodity, malware-as-a-service (MaaS) infostealers sold or rented on Russian-language cybercrime markets, not bespoke tooling built to target Anthropic or Claude specifically. Distribution followed the stealers' typical pattern of unofficial downloads and malicious/pirated applications; Anthropic and press coverage cite at least one affected user who traced their infection to a pirated game downloaded from a Russian-language underground forum.

Because the stolen material is a full authenticated browser session rather than a password, attackers were able to log in as the victim without triggering password-reset or new-device MFA prompts, and used the access to consume the victim's paid Claude usage quota rather than (per Anthropic's public statements) exfiltrating conversation content. Affected users reported usage limits refilling and then draining while they were not using the product themselves — a symptom Anthropic pointed to directly as a hijacking indicator. Some accounts also had unauthorized charges placed against saved payment methods.

Anthropic's incident response consisted of three operational moves: force-invalidating (signing out) all sessions identified as compromised, removing saved payment methods from affected accounts to stop further unauthorized charges, and issuing refunds for charges it identified as unauthorized. Anthropic's guidance to affected users emphasized that revoking the session alone is insufficient — the underlying malware infection must be found and removed, or the same device will simply exfiltrate a fresh session cookie the next time the user logs back in. Recommended remediation also included rotating the email account password (with 2FA enabled), updating any passwords the browser had saved, reviewing card statements, and clearing active sessions on other online services the same device had accessed, since a general-purpose infostealer harvests credentials and cookies for far more than one site at a time.

Acreed's presence on the list is notable in isolation: multiple 2025-2026 threat-intel reports (Bitsight, webz.io) describe Acreed's rapid rise to become one of the leading stealer-log sources on Russian Market and other dark-web marketplaces after a May 2025 law-enforcement disruption of LummaC2's infrastructure displaced Lumma affiliates toward rival services; Acreed research describes it combining C2 channels layered over Steam and the BNB Smart Chain with JSON-based exfiltration and DLL side-loading, and its stolen logs are redistributed through Telegram channels and dark-web stores. This positions the Claude-session campaign as an instance of a much broader, already-tracked commodity infostealer ecosystem rather than a novel or Claude-specific attack technique.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1027.002 Software Packing
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Pirated/Cracked Installer Execution Consistent With Vidar/Lumma/StealC/RedLine/Acreed Delivery** (`TL-2026-2253-SPL-001`)

Detects execution of unsigned, packed binaries launched from Downloads/Temp/user-writable paths shortly after a browser download, and often masquerading as a game crack, keygen, or installer. This is the confirmed initial-access vector Anthropic traced for the infostealer campaign that hijacked Claude session cookies (T1204.002), frequently paired with packed/obfuscated payloads (T1027.002) and filename masquerading (T1036).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1027.002, T1036
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage), img=lower(Image)
| where (like(img, "%\\downloads\\%") OR like(img, "%\\appdata\\local\\temp\\%") OR like(img, "%\\appdata\\roaming\\%"))
| where match(img, "(?i)(crack|keygen|patch|loader|setup|activator|repack)\.exe$") OR (Signed="false" AND match(CommandLine, "(?i)(unins|setup|install)"))
| eval is_browser_child=if(match(parent, "(chrome|msedge|firefox|brave|opera)\.exe$"), 1, 0)
| where is_browser_child=1 OR Signed="false"
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commandlines by Computer, User, Image, Hashes
| where count > 0
| table Computer, User, Image, Hashes, commandlines, first_seen, last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe")
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where FileName matches regex @"(?i)(crack|keygen|patch|loader|setup|activator|repack)\.exe$" or ProcessCommandLine matches regex @"(?i)(unins|setup|install)"
| where isnotempty(SHA256) and ( InitiatingProcessSignatureStatus != "Valid" or SignatureStatus != "Valid" or isempty(SignatureStatus) )
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName
| summarize count(), make_set(ProcessCommandLine, 20) by DeviceName, AccountName, FileName, SHA256
```

### Sigma

```yaml
title: Cracked/Pirated Software Installer Executed From Browser Download Path
id: 7f1c9a2e-3b6d-4e2a-9a1e-2f5b7c8d1a01
status: experimental
description: Detects execution of an unsigned, packed binary matching game-crack/keygen/loader naming conventions launched from a Downloads or Temp folder, spawned by a browser process. This is the confirmed initial-access vector for the Vidar/Lumma/StealC/RedLine/Acreed campaign that hijacked Claude session cookies.
references:
    - https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
    - attack.t1027.002
    - attack.malware.vidar
    - attack.malware.lumma_stealer
    - attack.malware.stealc
    - attack.malware.redline_stealer
    - attack.malware.acreed
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    selection_path:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    selection_name:
        Image|contains:
            - 'crack'
            - 'keygen'
            - 'patch'
            - 'loader'
            - 'activator'
            - 'repack'
    filter_signed:
        Signed: 'true'
    condition: selection_parent and selection_path and selection_name and not filter_signed
falsepositives:
    - Legitimate software activation tools in rare enterprise cases
    - Game modding utilities intentionally allow-listed by the organization
level: high
```

**Known false positives:**

- Legitimate unsigned internal tooling launched from a Downloads folder
- Software activation/licensing utilities intentionally allow-listed by IT

**Tuning notes:** Scope the browser-parent filter to your organization's standard browser set, and allow-list known-good internal packaging/activation tools by hash to reduce noise; widen the Downloads/Temp path list if users redirect these folders.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Sandbox-Evasive Process Launch From Browser-Downloaded Installer (locked: unlock with TL Creds)
- Browser and System Reconnaissance Followed by Local Data Staging (locked: unlock with TL Creds)
- Anomalous Claude/Anthropic Usage-Quota Consumption Without Corresponding Interactive Sign-In (locked: unlock with TL Creds)
- Command-Line Registry Run Key Creation Immediately After Suspicious Installer Execution (locked: unlock with TL Creds)
- Deobfuscation/Decode Routine in Unsigned Process Preceding Browser Data Access (locked: unlock with TL Creds)
- Steam/Epic Games API Dead-Drop and Known IOC C2 Beaconing With Web-Protocol Exfiltration (locked: unlock with TL Creds)
- Browser Cookie/Credential Store Access by Non-Browser Process With Autostart Persistence (locked: unlock with TL Creds)
- Stolen Claude Session Replay and Dead-Drop C2 Beaconing (Steam/Epic Games API/BNB Chain, Known IOC Infrastructure) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Anthropic locks out Claude users after infostealers hijack login sessions](https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/)
- [Anthropic warns infostealer malware is hijacking Claude sessions to drain usage](https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/)
- [Infostealers Are Hijacking Claude Sessions and Draining Subscriptions](https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions.html)
- [RedLine Stealer, Software S1240](https://attack.mitre.org/software/S1240/)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [Steal Web Session Cookie, Technique T1539](https://attack.mitre.org/techniques/T1539/)
- [Use Alternate Authentication Material: Web Session Cookie, Sub-technique T1550.004](https://attack.mitre.org/techniques/T1550/004/)
- [What is Acreed Infostealer? The Rise of Acreed](https://www.bitsight.com/blog/the-rise-of-acreed-infostealer)
- [Acreed Infostealer in 2026 - Everything We Know So Far](https://webz.io/dwp/acreed-infostealer-everything-we-know-so-far/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2253