Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage

Infostealer Malware (Vidar, LummaC2, StealC, RedLine (TL-2026-2255), also tracked as FakeAgent, is a medium-severity malware campaign, first published 2026-08-31. It has no confirmed attribution, affects Anthropic Claude (claude.ai, Claude Desktop, Claude accounts), maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-2255

Threat ID
TL-2026-2255
Also known as
FakeAgent
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-08-31
Last reviewed
2026-08-31
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software development, general consumer individual users
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in Infostealer Malware (Vidar, LummaC2, StealC, RedLine

Malware and tooling: AMOS, Acreed, Atomic Stealer, Lumma Stealer - S1213, LummaC2, RedLine Stealer - S1240, SectopRAT, Stealc, Vidar, 0xc1907d7be91f95903ad66d775c397302e7dd9228, 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228

Anthropic disclosed that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed on Windows; Atomic Stealer/AMOS on macOS) already resident on some users' devices is harvesting Claude session cookies and credentials, letting attackers replay stolen sessions to bypass 2FA/SSO, hijack accounts, and drain paid usage. The disclosure follows a directly Claude-branded malvertising campaign (Huntress-tracked "FakeAgent," July 2026) that used a fake ClaudeDesktop.exe installer to deploy the SectopRAT trojan, underscoring a broader pattern of malware specifically targeting AI-platform credentials and sessions.

How Infostealer Malware (Vidar, LummaC2, StealC, RedLine works

On August 30-31, 2026, Anthropic notified affected users that commodity infostealer malware already present on their devices had harvested saved passwords, browser login cookies, and locally stored application credentials, including active Claude session cookies. Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication and single sign-on entirely: attackers replay the stolen session to impersonate an already-logged-in user without ever supplying credentials. Anthropic said it detected the pattern after noticing usage limits that appeared to refill and then drain while account owners were inactive. The malware families named -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine Stealer, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs -- are general-purpose, financially motivated commodity stealers unrelated to Claude itself and typically arrive via unofficial downloads or malicious apps, not through any vulnerability in Claude. Anthropic's response was to sign out compromised sessions, remove saved payment methods from affected accounts, refund unauthorized charges, and warn that further misuse could trigger additional sign-outs; the company stressed that signing a user out stops the stolen session but does not remove the malware from the device.

Technically, this class of malware is well documented in MITRE ATT&CK: Lumma Stealer (S1213) and RedLine Stealer (S1240) both implement T1539 (Steal Web Session Cookie) and T1555.003 (Credentials from Web Browsers) as their core credential-theft techniques, alongside T1082 (System Information Discovery), T1005/T1113 (local data and screen collection), T1071.001 (web-protocol C2), T1041 (exfiltration over the C2 channel), and, for RedLine specifically, T1657 (Financial Theft) -- directly matching the usage-draining and payment-method-abuse pattern Anthropic observed. Both families also support T1204.002 (User Execution: Malicious File) as their infection vector and T1027/T1553.002 (packing and code-signing abuse) for defense evasion, consistent with delivery via unofficial or trojanized installers.

A directly Claude-branded campaign in the same threat window corroborates and extends this pattern: Huntress documented "FakeAgent," a malvertising operation active July 21-22, 2026, in which Bing search ads for "Claude Desktop app" redirected victims through claude.ai.download-app.us and downloading-api.it.com to a trojanized ClaudeDesktop.exe. That installer was in fact a repurposed, legitimate JetBrains JCEF helper binary abused to sideload a malicious libcef.dll (T1574.002), which persisted via a scheduled task disguised as DockerDesktop.exe (T1053.005) and ultimately decrypted an embedded, VMProtect-packed SectopRAT payload using a GPU-shader-based AES-256-CTR routine -- a technique that doubles as anti-sandbox evasion (T1497.001), since the decryption also checks for QEMU/VMware GPU signatures and low VRAM. SectopRAT is an HVNC-capable .NET RAT that gives attackers persistent remote access to browser passwords, cookies, credit-card data, and corporate files; its command-and-control used both conventional IPs and an EtherHiding-style scheme that staged payloads via BSC smart-contract transactions. Huntress observed at least 29 organizations compromised and roughly 7,100 downloads of the malicious Claude Artifact before Anthropic removed it; operator infrastructure for this cluster had been tracked since May 30, 2025, including a prior, technique-identical Docker Hub malvertising campaign in April 2026. SectopRAT is a distinct malware family from the six stealers named in Anthropic's own advisory, but it produces the same outcome -- stolen Claude sessions and credentials -- and confirms that attackers are deliberately targeting Claude's install/download surface, not just opportunistically harvesting sessions from generically infected machines.

The macOS side of the campaign (Atomic Stealer/AMOS) follows its own well-established 2026 distribution pattern: primarily cracked/pirated software, and increasingly "ClickFix"-style single-line, Base64-encoded Terminal commands surfaced via SEO-poisoned search and AI-chatbot results that trick users into granting silent Keychain access, plus quarantine-flag removal to bypass Gatekeeper (T1553.002) and spoofed code signatures (T1036.001). AMOS has separately been observed impersonating other AI-agent platforms outright -- a March 2026 case ("Clearly AI"/clearl.co) trojanized a fake OpenClaw client to the same end -- illustrating that AI-tool users and downloaders are a specifically targeted population for this malware class, not incidental victims.

Anthropic's remediation guidance to affected users was to fully remove the malware before re-adding any payment method, change passwords (including email) with 2FA enabled, update saved browser passwords, and revoke active sessions on other services reachable from the same device. Industry context: LummaC2 was itself the subject of a May 2025 global law-enforcement takedown (2,300+ domains seized per CISA advisory AA25-141B), after which Acreed emerged as the dominant infostealer strain on Russian Market crime forums -- explaining why Acreed appears alongside the four older, still-active families in Anthropic's list.

MITRE ATT&CK techniques used in TL-2026-2255

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Persistence

T1053 Scheduled Task/Job

Command and Control

T1071 Application Layer Protocol

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Execution

T1204 User Execution

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

defense-impairment

T1553 Subvert Trust Controls

stealth

T1574 Hijack Execution Flow

Impact

T1657 Financial Theft

Affected products and versions in Infostealer Malware (Vidar, LummaC2, StealC, RedLine

  • Anthropic — Claude (claude.ai, Claude Desktop, Claude accounts)
    Vulnerable versions: Any Claude account accessed from a Windows or macOS device infected with an infostealer
  • Microsoft — Windows (host OS targeted by Vidar, LummaC2, StealC, RedLine, Acreed, SectopRAT)
    Vulnerable versions: Windows 10/11 devices lacking EDR/AV, running software from unofficial sources
  • Apple — macOS (host OS targeted by Atomic Stealer/AMOS)
    Vulnerable versions: macOS devices running pirated/cracked applications or ClickFix-style Terminal commands

Remediation for Infostealer Malware (Vidar, LummaC2, StealC, RedLine

Patches

  • No vendor patch applies -- this is a credential/session-theft campaign via host malware, not a software vulnerability in Claude

Immediate actions

  • Run a full anti-malware/EDR scan on any device that has ever accessed Claude before re-adding payment information or re-authenticating
  • Force sign-out and revoke all active Claude sessions on potentially affected accounts
  • Rotate passwords for Claude, the associated email account, and any other service reachable from the infected device, and (re-)enable 2FA
  • Block the known FakeAgent/SectopRAT C2 IPs and impersonating domains (claude.ai.download-app.us, downloading-api.it.com) at DNS resolvers and network perimeters

Workarounds

  • Only install Claude Desktop or any AI-tool client from claude.ai's official channels; treat installers reached via search ads or third-party download sites as untrusted
  • On macOS, avoid pirated/cracked software and never paste Terminal commands surfaced by search engines or AI chatbots without independently verifying them (ClickFix technique)

Longer-term hardening

  • Deploy EDR/detection content for browser session-cookie exfiltration behavior (MITRE T1539) rather than relying on password- or OTP-based controls alone
  • Where the platform supports it, move toward phishing-resistant, device-bound session tokens, since stolen-cookie replay defeats standard password + OTP 2FA
  • Restrict endpoint software installation to signed packages from verified vendor channels; block execution of binaries downloaded via search-ad redirects or unofficial mirrors
  • Monitor for anomalous platform-usage patterns (e.g., quota consumption while the account owner is inactive) as an account-takeover detection signal

Weaknesses (CWE) in Infostealer Malware (Vidar, LummaC2, StealC, RedLine

CWE-294

Timeline of Infostealer Malware (Vidar, LummaC2, StealC, RedLine

  • Global law-enforcement operation seizes 2,300+ LummaC2 domains (per CISA advisory AA25-141B), disrupting the then-dominant infostealer family.
  • Huntress later attributes the operator infrastructure behind the FakeAgent/SectopRAT campaign to activity tracked back to this date, predating the Claude-branded lure by over a year.
  • Atomic Stealer (AMOS) campaign observed impersonating the OpenClaw AI-agent platform via a fake "Clearly AI" app (clearl.co, Cleal_AI.dmg), illustrating AMOS's pattern of targeting AI-tool users specifically.
  • A technique-identical malvertising campaign abuses Docker Hub with the same libcef.dll sideloading method later reused against Claude Desktop, per Huntress.
  • The malicious domain claude.ai.download-app.us, used to redirect victims to the trojanized ClaudeDesktop.exe installer, is registered.
  • Atomic Stealer (AMOS) adds hardware-wallet trojanization and hidden LaunchDaemon persistence, per a Brinztech breach alert.
  • Huntress detects the start of the FakeAgent campaign: Bing search ads for "Claude Desktop app" begin redirecting victims to a fake, malicious installer that deploys SectopRAT via DLL sideloading.
  • FakeAgent campaign window closes after compromising at least 29 organizations and accumulating roughly 7,100 downloads of the malicious Claude Artifact; Anthropic removes the artifact.
  • Anthropic begins notifying users that commodity infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) harvested Claude session cookies, and starts signing out compromised sessions, removing saved payment methods, and issuing refunds.
  • SecurityWeek, BleepingComputer, Help Net Security, and other outlets independently corroborate and detail Anthropic's infostealer disclosure.

Sources cited for Infostealer Malware (Vidar, LummaC2, StealC, RedLine

More in malware

Detection coverage for TL-2026-2255

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2255 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2255

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats