Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage
Infostealer Malware (Vidar, LummaC2, StealC, RedLine (TL-2026-2255), also tracked as FakeAgent, is a medium-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Anthropic Claude (claude.ai, Claude Desktop, Claude accounts), maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-2255
- Threat ID
- TL-2026-2255
- Also known as
- FakeAgent
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-31
- Last reviewed
- 2026-08-31
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, general consumer individual users
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in Infostealer Malware (Vidar, LummaC2, StealC, RedLine
Malware and tooling: AMOS, Acreed, Atomic Stealer, Lumma Stealer - S1213, LummaC2, RedLine Stealer - S1240, SectopRAT, Stealc, Vidar, 0xc1907d7be91f95903ad66d775c397302e7dd9228, 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228
Anthropic disclosed that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed on Windows; Atomic Stealer/AMOS on macOS) already resident on some users' devices is harvesting Claude session cookies and credentials, letting attackers replay stolen sessions to bypass 2FA/SSO, hijack accounts, and drain paid usage. The disclosure follows a directly Claude-branded malvertising campaign (Huntress-tracked "FakeAgent," July 2026) that used a fake ClaudeDesktop.exe installer to deploy the SectopRAT trojan, underscoring a broader pattern of malware specifically targeting AI-platform credentials and sessions.
How Infostealer Malware (Vidar, LummaC2, StealC, RedLine works
On August 30-31, 2026, Anthropic notified affected users that commodity infostealer malware already present on their devices had harvested saved passwords, browser login cookies, and locally stored application credentials, including active Claude session cookies. Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication and single sign-on entirely: attackers replay the stolen session to impersonate an already-logged-in user without ever supplying credentials. Anthropic said it detected the pattern after noticing usage limits that appeared to refill and then drain while account owners were inactive. The malware families named -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine Stealer, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs -- are general-purpose, financially motivated commodity stealers unrelated to Claude itself and typically arrive via unofficial downloads or malicious apps, not through any vulnerability in Claude. Anthropic's response was to sign out compromised sessions, remove saved payment methods from affected accounts, refund unauthorized charges, and warn that further misuse could trigger additional sign-outs; the company stressed that signing a user out stops the stolen session but does not remove the malware from the device.
Technically, this class of malware is well documented in MITRE ATT&CK: Lumma Stealer (S1213) and RedLine Stealer (S1240) both implement T1539 (Steal Web Session Cookie) and T1555.003 (Credentials from Web Browsers) as their core credential-theft techniques, alongside T1082 (System Information Discovery), T1005/T1113 (local data and screen collection), T1071.001 (web-protocol C2), T1041 (exfiltration over the C2 channel), and, for RedLine specifically, T1657 (Financial Theft) -- directly matching the usage-draining and payment-method-abuse pattern Anthropic observed. Both families also support T1204.002 (User Execution: Malicious File) as their infection vector and T1027/T1553.002 (packing and code-signing abuse) for defense evasion, consistent with delivery via unofficial or trojanized installers.
A directly Claude-branded campaign in the same threat window corroborates and extends this pattern: Huntress documented "FakeAgent," a malvertising operation active July 21-22, 2026, in which Bing search ads for "Claude Desktop app" redirected victims through claude.ai.download-app.us and downloading-api.it.com to a trojanized ClaudeDesktop.exe. That installer was in fact a repurposed, legitimate JetBrains JCEF helper binary abused to sideload a malicious libcef.dll (T1574.002), which persisted via a scheduled task disguised as DockerDesktop.exe (T1053.005) and ultimately decrypted an embedded, VMProtect-packed SectopRAT payload using a GPU-shader-based AES-256-CTR routine -- a technique that doubles as anti-sandbox evasion (T1497.001), since the decryption also checks for QEMU/VMware GPU signatures and low VRAM. SectopRAT is an HVNC-capable .NET RAT that gives attackers persistent remote access to browser passwords, cookies, credit-card data, and corporate files; its command-and-control used both conventional IPs and an EtherHiding-style scheme that staged payloads via BSC smart-contract transactions. Huntress observed at least 29 organizations compromised and roughly 7,100 downloads of the malicious Claude Artifact before Anthropic removed it; operator infrastructure for this cluster had been tracked since May 30, 2025, including a prior, technique-identical Docker Hub malvertising campaign in April 2026. SectopRAT is a distinct malware family from the six stealers named in Anthropic's own advisory, but it produces the same outcome -- stolen Claude sessions and credentials -- and confirms that attackers are deliberately targeting Claude's install/download surface, not just opportunistically harvesting sessions from generically infected machines.
The macOS side of the campaign (Atomic Stealer/AMOS) follows its own well-established 2026 distribution pattern: primarily cracked/pirated software, and increasingly "ClickFix"-style single-line, Base64-encoded Terminal commands surfaced via SEO-poisoned search and AI-chatbot results that trick users into granting silent Keychain access, plus quarantine-flag removal to bypass Gatekeeper (T1553.002) and spoofed code signatures (T1036.001). AMOS has separately been observed impersonating other AI-agent platforms outright -- a March 2026 case ("Clearly AI"/clearl.co) trojanized a fake OpenClaw client to the same end -- illustrating that AI-tool users and downloaders are a specifically targeted population for this malware class, not incidental victims.
Anthropic's remediation guidance to affected users was to fully remove the malware before re-adding any payment method, change passwords (including email) with 2FA enabled, update saved browser passwords, and revoke active sessions on other services reachable from the same device. Industry context: LummaC2 was itself the subject of a May 2025 global law-enforcement takedown (2,300+ domains seized per CISA advisory AA25-141B), after which Acreed emerged as the dominant infostealer strain on Russian Market crime forums -- explaining why Acreed appears alongside the four older, still-active families in Anthropic's list.
MITRE ATT&CK techniques used in TL-2026-2255
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
Command and Control
T1071 Application Layer Protocol
Discovery
T1082 System Information Discovery
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
Execution
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
defense-impairment
stealth
Impact
Affected products and versions in Infostealer Malware (Vidar, LummaC2, StealC, RedLine
- Anthropic — Claude (claude.ai, Claude Desktop, Claude accounts)
Vulnerable versions: Any Claude account accessed from a Windows or macOS device infected with an infostealer - Microsoft — Windows (host OS targeted by Vidar, LummaC2, StealC, RedLine, Acreed, SectopRAT)
Vulnerable versions: Windows 10/11 devices lacking EDR/AV, running software from unofficial sources - Apple — macOS (host OS targeted by Atomic Stealer/AMOS)
Vulnerable versions: macOS devices running pirated/cracked applications or ClickFix-style Terminal commands
Remediation for Infostealer Malware (Vidar, LummaC2, StealC, RedLine
Patches
- No vendor patch applies -- this is a credential/session-theft campaign via host malware, not a software vulnerability in Claude
Immediate actions
- Run a full anti-malware/EDR scan on any device that has ever accessed Claude before re-adding payment information or re-authenticating
- Force sign-out and revoke all active Claude sessions on potentially affected accounts
- Rotate passwords for Claude, the associated email account, and any other service reachable from the infected device, and (re-)enable 2FA
- Block the known FakeAgent/SectopRAT C2 IPs and impersonating domains (claude.ai.download-app.us, downloading-api.it.com) at DNS resolvers and network perimeters
Workarounds
- Only install Claude Desktop or any AI-tool client from claude.ai's official channels; treat installers reached via search ads or third-party download sites as untrusted
- On macOS, avoid pirated/cracked software and never paste Terminal commands surfaced by search engines or AI chatbots without independently verifying them (ClickFix technique)
Longer-term hardening
- Deploy EDR/detection content for browser session-cookie exfiltration behavior (MITRE T1539) rather than relying on password- or OTP-based controls alone
- Where the platform supports it, move toward phishing-resistant, device-bound session tokens, since stolen-cookie replay defeats standard password + OTP 2FA
- Restrict endpoint software installation to signed packages from verified vendor channels; block execution of binaries downloaded via search-ad redirects or unofficial mirrors
- Monitor for anomalous platform-usage patterns (e.g., quota consumption while the account owner is inactive) as an account-takeover detection signal
Weaknesses (CWE) in Infostealer Malware (Vidar, LummaC2, StealC, RedLine
CWE-294
Timeline of Infostealer Malware (Vidar, LummaC2, StealC, RedLine
- Global law-enforcement operation seizes 2,300+ LummaC2 domains (per CISA advisory AA25-141B), disrupting the then-dominant infostealer family.
- Huntress later attributes the operator infrastructure behind the FakeAgent/SectopRAT campaign to activity tracked back to this date, predating the Claude-branded lure by over a year.
- Atomic Stealer (AMOS) campaign observed impersonating the OpenClaw AI-agent platform via a fake "Clearly AI" app (clearl.co, Cleal_AI.dmg), illustrating AMOS's pattern of targeting AI-tool users specifically.
- A technique-identical malvertising campaign abuses Docker Hub with the same libcef.dll sideloading method later reused against Claude Desktop, per Huntress.
- The malicious domain claude.ai.download-app.us, used to redirect victims to the trojanized ClaudeDesktop.exe installer, is registered.
- Atomic Stealer (AMOS) adds hardware-wallet trojanization and hidden LaunchDaemon persistence, per a Brinztech breach alert.
- Huntress detects the start of the FakeAgent campaign: Bing search ads for "Claude Desktop app" begin redirecting victims to a fake, malicious installer that deploys SectopRAT via DLL sideloading.
- FakeAgent campaign window closes after compromising at least 29 organizations and accumulating roughly 7,100 downloads of the malicious Claude Artifact; Anthropic removes the artifact.
- Anthropic begins notifying users that commodity infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) harvested Claude session cookies, and starts signing out compromised sessions, removing saved payment methods, and issuing refunds.
- SecurityWeek, BleepingComputer, Help Net Security, and other outlets independently corroborate and detail Anthropic's infostealer disclosure.
Sources cited for Infostealer Malware (Vidar, LummaC2, StealC, RedLine
- Anthropic warns Claude users of infostealer malware infections
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
- Anthropic locks out Claude users after infostealers hijack login sessions
- Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts
- Infostealers Are Hijacking Claude Sessions and Draining Subscriptions
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Fake Claude app promoted by Bing ads pushes SectopRAT malware
- Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2
- Lumma Stealer, Software S1213
- RedLine Stealer, Software S1240
- Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations
- LummaC2 Fractures as Acreed Malware Becomes Top Dog
- Atomic macOS stealer is mimicking an AI agent tool for Mac
- Brinztech Alert: Evolution of Atomic macOS Stealer (AMOS) - June 2026 Update
- Anthropic Warns Of Infostealers Hijacking Claude Sessions
More in malware
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
Detection coverage for TL-2026-2255
As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2255 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2255
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.