Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage

Key facts for Infostealers hijacking Claude sessions

Detection coverage for Infostealers hijacking Claude sessions

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2255 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Trojanized ClaudeDesktop.exe Installer Execution via Malvertising Redirect

Detects execution of a fake ClaudeDesktop.exe or DockerDesktop.exe launched from a non-standard directory, optionally correlated with a preceding web request to the known FakeAgent malvertising redirect infrastructure (claude.ai.download-app.us, downloading-api.it.com), indicating supply-chain-style trojanized installer delivery ahead of DLL side-loading and SectopRAT deployment.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1195, T1204
• Data sources: sysmon, web_proxy, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon (EventCode=1 OR EventCode=22)
| eval proc_name=lower(Image)
| where match(proc_name, "claudedesktop\.exe$") OR match(proc_name, "dockerdesktop\.exe$")
| where NOT match(Image, "(?i)\\Program Files\\Claude\\")
| eval susp_path=if(match(Image, "(?i)\\(Downloads|AppData\\Local\\Temp|Temp)\\"), 1, 0)
| join type=left ParentProcessId [ search index=proxy OR index=web_proxy (dest_domain="claude.ai.download-app.us" OR dest_domain="downloading-api.it.com" OR query="claude.ai.download-app.us" OR query="downloading-api.it.com") | rename dest_domain as referrer_domain | fields referrer_domain, dest_ip, _time ]
| where susp_path=1 OR isnotnull(referrer_domain)
| table _time, host, user, Image, CommandLine, ParentImage, susp_path, referrer_domain, dest_ip
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("ClaudeDesktop.exe", "DockerDesktop.exe")
| where FolderPath !contains @"\Program Files\Claude\"
| where FolderPath has_any (@"\Downloads\", @"\AppData\Local\Temp\", @"\Temp\")
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("claude.ai.download-app.us", "downloading-api.it.com")
      or RemoteIP in ("2.24.131.246")
    | project DeviceId, NetTimestamp = Timestamp, RemoteUrl, RemoteIP
) on DeviceId
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Timestamp desc

Sigma

title: Trojanized ClaudeDesktop.exe Installer Execution from Non-Standard Path
id: 7c1e2a4a-3b1e-4f2a-9c6b-1a2b3c4d5e6f
status: experimental
description: Detects execution of a binary named ClaudeDesktop.exe or DockerDesktop.exe launched from a Downloads or Temp directory rather than the legitimate Program Files install path, consistent with the FakeAgent malvertising campaign delivering a trojanized JCEF-based installer that sideloads SectopRAT.
references:
    - https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1566
    - attack.t1195
    - attack.execution
    - attack.t1204.002
    - attack.tool.sectoprat
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\ClaudeDesktop.exe'
            - '\DockerDesktop.exe'
    filter_legit_path:
        Image|contains: '\Program Files\Claude\'
    selection_susp_path:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Temp\'
    condition: selection_image and selection_susp_path and not filter_legit_path
falsepositives:
    - Legitimate Docker Desktop or Claude Desktop reinstall/repair executed manually from a Downloads folder
level: high

Known false positives:

• Legitimate manual reinstall of Claude Desktop or Docker Desktop launched from a Downloads folder before being moved to Program Files
• Corporate software packaging tools that stage installers in Temp before silent install

Tuning notes: Add an allow-list for your organization's approved software deployment tool (SCCM/Intune) staging paths; extend the domain match list with newly observed FakeAgent redirect infrastructure as Huntress/Anthropic publish updates.

• 🔒 libcef.dll Sideloading via Repurposed JCEF Helper Binary (FakeAgent) · unlock with TL Creds
• 🔒 macOS ClickFix Terminal Lure and Gatekeeper Quarantine-Flag Removal (Atomic Stealer) · unlock with TL Creds
• 🔒 Anomalous Claude Session Reuse and Usage-Quota Drain During Owner Inactivity · unlock with TL Creds
• 🔒 Scheduled Task Persistence Disguised as DockerDesktop.exe · unlock with TL Creds
• 🔒 SectopRAT VMProtect Payload Decryption with GPU/VM Sandbox Fingerprinting · unlock with TL Creds
• 🔒 EtherHiding-Style Blockchain C2 via BSC Smart Contract Calls · unlock with TL Creds
• 🔒 Browser Cookie/Credential Store Access by Non-Browser Process (Infostealer Harvest) · unlock with TL Creds
• 🔒 Network Beacon to Known SectopRAT/Infostealer C2 Infrastructure · unlock with TL Creds

Indicators of compromise for Infostealers hijacking Claude sessions

As of 2026-08-31, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-2255.

Sample indicators (3 of 27)

• IP address: 2.24.131[.]246
• Domain: claude[.]ai[.]download-app[.]us
• File hash: f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Community OSINT corroboration for Infostealers hijacking Claude sessions

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Infostealers hijacking Claude sessions works

The disclosure follows a directly Claude-branded malvertising campaign (Huntress-tracked "FakeAgent," July 2026) that used a fake ClaudeDesktop.exe installer to deploy the SectopRAT trojan, underscoring a broader pattern of malware specifically targeting AI-platform credentials and sessions.

On August 30-31, 2026, Anthropic notified affected users that commodity infostealer malware already present on their devices had harvested saved passwords, browser login cookies, and locally stored application credentials, including active Claude session cookies. Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication and single sign-on entirely: attackers replay the stolen session to impersonate an already-logged-in user without ever supplying credentials. Anthropic said it detected the pattern after noticing usage limits that appeared to refill and then drain while account owners were inactive. The malware families named -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine Stealer, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs -- are general-purpose, financially motivated commodity stealers unrelated to Claude itself and typically arrive via unofficial downloads or malicious apps, not through any vulnerability in Claude. Anthropic's response was to sign out compromised sessions, remove saved payment methods from affected accounts, refund unauthorized charges, and warn that further misuse could trigger additional sign-outs; the company stressed that signing a user out stops the stolen session but does not remove the malware from the device.

Technically, this class of malware is well documented in MITRE ATT&CK: Lumma Stealer (S1213) and RedLine Stealer (S1240) both implement T1539 (Steal Web Session Cookie) and T1555.003 (Credentials from Web Browsers) as their core credential-theft techniques, alongside T1082 (System Information Discovery), T1005/T1113 (local data and screen collection), T1071.001 (web-protocol C2), T1041 (exfiltration over the C2 channel), and, for RedLine specifically, T1657 (Financial Theft) -- directly matching the usage-draining and payment-method-abuse pattern Anthropic observed. Both families also support T1204.002 (User Execution: Malicious File) as their infection vector and T1027/T1553.002 (packing and code-signing abuse) for defense evasion, consistent with delivery via unofficial or trojanized installers.

A directly Claude-branded campaign in the same threat window corroborates and extends this pattern: Huntress documented "FakeAgent," a malvertising operation active July 21-22, 2026, in which Bing search ads for "Claude Desktop app" redirected victims through claude.ai.download-app.us and downloading-api.it.com to a trojanized ClaudeDesktop.exe. That installer was in fact a repurposed, legitimate JetBrains JCEF helper binary abused to sideload a malicious libcef.dll (T1574.002), which persisted via a scheduled task disguised as DockerDesktop.exe (T1053.005) and ultimately decrypted an embedded, VMProtect-packed SectopRAT payload using a GPU-shader-based AES-256-CTR routine -- a technique that doubles as anti-sandbox evasion (T1497.001), since the decryption also checks for QEMU/VMware GPU signatures and low VRAM. SectopRAT is an HVNC-capable .NET RAT that gives attackers persistent remote access to browser passwords, cookies, credit-card data, and corporate files; its command-and-control used both conventional IPs and an EtherHiding-style scheme that staged payloads via BSC smart-contract transactions. Huntress observed at least 29 organizations compromised and roughly 7,100 downloads of the malicious Claude Artifact before Anthropic removed it; operator infrastructure for this cluster had been tracked since May 30, 2025, including a prior, technique-identical Docker Hub malvertising campaign in April 2026. SectopRAT is a distinct malware family from the six stealers named in Anthropic's own advisory, but it produces the same outcome -- stolen Claude sessions and credentials -- and confirms that attackers are deliberately targeting Claude's install/download surface, not just opportunistically harvesting sessions from generically infected machines.

The macOS side of the campaign (Atomic Stealer/AMOS) follows its own well-established 2026 distribution pattern: primarily cracked/pirated software, and increasingly "ClickFix"-style single-line, Base64-encoded Terminal commands surfaced via SEO-poisoned search and AI-chatbot results that trick users into granting silent Keychain access, plus quarantine-flag removal to bypass Gatekeeper (T1553.002) and spoofed code signatures (T1036.001). AMOS has separately been observed impersonating other AI-agent platforms outright -- a March 2026 case ("Clearly AI"/clearl.co) trojanized a fake OpenClaw client to the same end -- illustrating that AI-tool users and downloaders are a specifically targeted population for this malware class, not incidental victims.

Anthropic's remediation guidance to affected users was to fully remove the malware before re-adding any payment method, change passwords (including email) with 2FA enabled, update saved browser passwords, and revoke active sessions on other services reachable from the same device. Industry context: LummaC2 was itself the subject of a May 2025 global law-enforcement takedown (2,300+ domains seized per CISA advisory AA25-141B), after which Acreed emerged as the dominant infostealer strain on Russian Market crime forums -- explaining why Acreed appears alongside the four older, still-active families in Anthropic's list.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Persistence

T1053 Scheduled Task/Job

Command and Control

T1071 Application Layer Protocol

Discovery

T1082 System Information Discovery

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Execution

T1204 User Execution

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

defense-impairment

T1553 Subvert Trust Controls

stealth

T1574 Hijack Execution Flow

Impact

T1657 Financial Theft

Remediation for Infostealers hijacking Claude sessions

Patches

• No vendor patch applies -- this is a credential/session-theft campaign via host malware, not a software vulnerability in Claude

Immediate actions

• Run a full anti-malware/EDR scan on any device that has ever accessed Claude before re-adding payment information or re-authenticating
• Force sign-out and revoke all active Claude sessions on potentially affected accounts
• Rotate passwords for Claude, the associated email account, and any other service reachable from the infected device, and (re-)enable 2FA
• Block the known FakeAgent/SectopRAT C2 IPs and impersonating domains (claude.ai.download-app.us, downloading-api.it.com) at DNS resolvers and network perimeters

Workarounds

• Only install Claude Desktop or any AI-tool client from claude.ai's official channels; treat installers reached via search ads or third-party download sites as untrusted
• On macOS, avoid pirated/cracked software and never paste Terminal commands surfaced by search engines or AI chatbots without independently verifying them (ClickFix technique)

Longer-term hardening

• Deploy EDR/detection content for browser session-cookie exfiltration behavior (MITRE T1539) rather than relying on password- or OTP-based controls alone
• Where the platform supports it, move toward phishing-resistant, device-bound session tokens, since stolen-cookie replay defeats standard password + OTP 2FA
• Restrict endpoint software installation to signed packages from verified vendor channels; block execution of binaries downloaded via search-ad redirects or unofficial mirrors
• Monitor for anomalous platform-usage patterns (e.g., quota consumption while the account owner is inactive) as an account-takeover detection signal

Affected and fixed versions

• Anthropic — Claude (claude.ai, Claude Desktop, Claude accounts)
  Vulnerable versions: Any Claude account accessed from a Windows or macOS device infected with an infostealer
• Microsoft — Windows (host OS targeted by Vidar, LummaC2, StealC, RedLine, Acreed, SectopRAT)
  Vulnerable versions: Windows 10/11 devices lacking EDR/AV, running software from unofficial sources
• Apple — macOS (host OS targeted by Atomic Stealer/AMOS)
  Vulnerable versions: macOS devices running pirated/cracked applications or ClickFix-style Terminal commands

Timeline of Infostealers hijacking Claude sessions

• 2025-05-01 Global law-enforcement operation seizes 2,300+ locked-ioc-24 domains (per CISA advisory AA25-141B), disrupting the then-dominant infostealer family.
• 2025-05-30 Huntress later attributes the operator infrastructure behind the FakeAgent/locked-ioc-22 campaign to activity tracked back to this date, predating the Claude-branded lure by over a year.
• 2026-03-24 locked-ioc-13 (AMOS) campaign observed impersonating the OpenClaw AI-agent platform via a fake "Clearly AI" app (locked-ioc-21, Cleal_AI.dmg), illustrating AMOS's pattern of targeting AI-tool users specifically.
• 2026-04-01 A technique-identical malvertising campaign abuses Docker Hub with the same libcef.dll sideloading method later reused against Claude Desktop, per Huntress.
• 2026-05-09 The malicious domain locked-ioc-8, used to redirect victims to the trojanized ClaudeDesktop.exe installer, is registered.
• 2026-06-01 locked-ioc-13 (AMOS) adds hardware-wallet trojanization and hidden LaunchDaemon persistence, per a Brinztech breach alert.
• 2026-07-21 Huntress detects the start of the FakeAgent campaign: Bing search ads for "Claude Desktop app" begin redirecting victims to a fake, malicious installer that deploys locked-ioc-22 via DLL sideloading.
• 2026-07-22 FakeAgent campaign window closes after compromising at least 29 organizations and accumulating roughly 7,100 downloads of the malicious Claude Artifact; Anthropic removes the artifact.
• 2026-08-30 Anthropic begins notifying users that commodity infostealers (locked-ioc-27, locked-ioc-24, locked-ioc-25, RedLine, locked-ioc-26, locked-ioc-13) harvested Claude session cookies, and starts signing out compromised sessions, removing saved payment methods, and issuing refunds.
• 2026-08-31 SecurityWeek, BleepingComputer, Help Net Security, and other outlets independently corroborate and detail Anthropic's infostealer disclosure.

Sources cited for Infostealers hijacking Claude sessions

• Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations CISA · Government advisory · 2025-05-21
• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT Huntress · Research · 2026-07-25
• Lumma Stealer, Software S1213 MITRE · Research · 2026-08-31
• RedLine Stealer, Software S1240 MITRE · Research · 2026-08-31
• Atomic macOS stealer is mimicking an AI agent tool for Mac moonlock.com · Research · 2026-03-24
• Brinztech Alert: Evolution of Atomic macOS Stealer (AMOS) - June 2026 Update brinztech.com · Vendor report · 2026-06-01
• Anthropic warns Claude users of infostealer malware infections SecurityWeek · News · 2026-08-31
• Anthropic warns infostealer malware is hijacking Claude sessions to drain usage BleepingComputer · News · 2026-08-30
• Anthropic locks out Claude users after infostealers hijack login sessions Help Net Security · News · 2026-08-31
• Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts cybersecuritynews.com · News · 2026-08-31
• Infostealers Are Hijacking Claude Sessions and Draining Subscriptions securityaffairs.com · News · 2026-08-31
• Fake Claude app promoted by Bing ads pushes SectopRAT malware BleepingComputer · News · 2026-07-25
• Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2 gbhackers.com · News · 2026-07-25
• LummaC2 Fractures as Acreed Malware Becomes Top Dog Dark Reading · News · 2026-08-31
• Anthropic Warns Of Infostealers Hijacking Claude Sessions thecyberexpress.com · News · 2026-08-31

Threats related to Infostealers hijacking Claude sessions

• Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malware
• FakeAgent Malvertising Campaign Distributes SectopRAT via Fake Claude Desktop Installer Hosted on claude.ai
• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer
• Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns

Related coverage of this activity

• StealC Amadey Operation Endgame takedown

Previous and next in malware

• Anthropic Locks Out Claude Users After Commodity Infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijack Login Sessions Previous report
• ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading Next report