# Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage

> Anthropic disclosed that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, Acreed on Windows; Atomic Stealer/AMOS on macOS) already resident on some users' devices is harvesting Claude session cookies and credentials, letting attackers replay stolen sessions to bypass 2FA/SSO, hijack accounts, and drain paid usage. The disclosure follows a directly Claude-branded malvertising campaign (Huntress-tracked "FakeAgent," July 2026) that used a fake ClaudeDesktop.exe installer to deploy the SectopRAT trojan, underscoring a broader pattern of malware specifically targeting AI-platform credentials and sessions.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2255
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-infostealers-hijacking-claude-sessions-tl-2026-2255.webp?v=aa4be9fd (Threadlinqs threat intel: Claude Session Theft via Vidar, LummaC2: Detection & IOCs (TL-2026-2255) — Medium severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-2255
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

On August 30-31, 2026, Anthropic notified affected users that commodity infostealer malware already present on their devices had harvested saved passwords, browser login cookies, and locally stored application credentials, including active Claude session cookies. Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication and single sign-on entirely: attackers replay the stolen session to impersonate an already-logged-in user without ever supplying credentials. Anthropic said it detected the pattern after noticing usage limits that appeared to refill and then drain while account owners were inactive. The malware families named -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine Stealer, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs -- are general-purpose, financially motivated commodity stealers unrelated to Claude itself and typically arrive via unofficial downloads or malicious apps, not through any vulnerability in Claude. Anthropic's response was to sign out compromised sessions, remove saved payment methods from affected accounts, refund unauthorized charges, and warn that further misuse could trigger additional sign-outs; the company stressed that signing a user out stops the stolen session but does not remove the malware from the device.

Technically, this class of malware is well documented in MITRE ATT&CK: Lumma Stealer (S1213) and RedLine Stealer (S1240) both implement T1539 (Steal Web Session Cookie) and T1555.003 (Credentials from Web Browsers) as their core credential-theft techniques, alongside T1082 (System Information Discovery), T1005/T1113 (local data and screen collection), T1071.001 (web-protocol C2), T1041 (exfiltration over the C2 channel), and, for RedLine specifically, T1657 (Financial Theft) -- directly matching the usage-draining and payment-method-abuse pattern Anthropic observed. Both families also support T1204.002 (User Execution: Malicious File) as their infection vector and T1027/T1553.002 (packing and code-signing abuse) for defense evasion, consistent with delivery via unofficial or trojanized installers.

A directly Claude-branded campaign in the same threat window corroborates and extends this pattern: Huntress documented "FakeAgent," a malvertising operation active July 21-22, 2026, in which Bing search ads for "Claude Desktop app" redirected victims through claude.ai.download-app.us and downloading-api.it.com to a trojanized ClaudeDesktop.exe. That installer was in fact a repurposed, legitimate JetBrains JCEF helper binary abused to sideload a malicious libcef.dll (T1574.002), which persisted via a scheduled task disguised as DockerDesktop.exe (T1053.005) and ultimately decrypted an embedded, VMProtect-packed SectopRAT payload using a GPU-shader-based AES-256-CTR routine -- a technique that doubles as anti-sandbox evasion (T1497.001), since the decryption also checks for QEMU/VMware GPU signatures and low VRAM. SectopRAT is an HVNC-capable .NET RAT that gives attackers persistent remote access to browser passwords, cookies, credit-card data, and corporate files; its command-and-control used both conventional IPs and an EtherHiding-style scheme that staged payloads via BSC smart-contract transactions. Huntress observed at least 29 organizations compromised and roughly 7,100 downloads of the malicious Claude Artifact before Anthropic removed it; operator infrastructure for this cluster had been tracked since May 30, 2025, including a prior, technique-identical Docker Hub malvertising campaign in April 2026. SectopRAT is a distinct malware family from the six stealers named in Anthropic's own advisory, but it produces the same outcome -- stolen Claude sessions and credentials -- and confirms that attackers are deliberately targeting Claude's install/download surface, not just opportunistically harvesting sessions from generically infected machines.

The macOS side of the campaign (Atomic Stealer/AMOS) follows its own well-established 2026 distribution pattern: primarily cracked/pirated software, and increasingly "ClickFix"-style single-line, Base64-encoded Terminal commands surfaced via SEO-poisoned search and AI-chatbot results that trick users into granting silent Keychain access, plus quarantine-flag removal to bypass Gatekeeper (T1553.002) and spoofed code signatures (T1036.001). AMOS has separately been observed impersonating other AI-agent platforms outright -- a March 2026 case ("Clearly AI"/clearl.co) trojanized a fake OpenClaw client to the same end -- illustrating that AI-tool users and downloaders are a specifically targeted population for this malware class, not incidental victims.

Anthropic's remediation guidance to affected users was to fully remove the malware before re-adding any payment method, change passwords (including email) with 2FA enabled, update saved browser passwords, and revoke active sessions on other services reachable from the same device. Industry context: LummaC2 was itself the subject of a May 2025 global law-enforcement takedown (2,300+ domains seized per CISA advisory AA25-141B), after which Acreed emerged as the dominant infostealer strain on Russian Market crime forums -- explaining why Acreed appears alongside the four older, still-active families in Anthropic's list.

## MITRE ATT&CK

- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1574 Hijack Execution Flow
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized ClaudeDesktop.exe Installer Execution via Malvertising Redirect** (`TL-2026-2255-SPL-001`)

Detects execution of a fake ClaudeDesktop.exe or DockerDesktop.exe launched from a non-standard directory, optionally correlated with a preceding web request to the known FakeAgent malvertising redirect infrastructure (claude.ai.download-app.us, downloading-api.it.com), indicating supply-chain-style trojanized installer delivery ahead of DLL side-loading and SectopRAT deployment.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566, T1195, T1204
- **Data sources:** sysmon, web_proxy, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon (EventCode=1 OR EventCode=22)
| eval proc_name=lower(Image)
| where match(proc_name, "claudedesktop\.exe$") OR match(proc_name, "dockerdesktop\.exe$")
| where NOT match(Image, "(?i)\\Program Files\\Claude\\")
| eval susp_path=if(match(Image, "(?i)\\(Downloads|AppData\\Local\\Temp|Temp)\\"), 1, 0)
| join type=left ParentProcessId [ search index=proxy OR index=web_proxy (dest_domain="claude.ai.download-app.us" OR dest_domain="downloading-api.it.com" OR query="claude.ai.download-app.us" OR query="downloading-api.it.com") | rename dest_domain as referrer_domain | fields referrer_domain, dest_ip, _time ]
| where susp_path=1 OR isnotnull(referrer_domain)
| table _time, host, user, Image, CommandLine, ParentImage, susp_path, referrer_domain, dest_ip
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("ClaudeDesktop.exe", "DockerDesktop.exe")
| where FolderPath !contains @"\Program Files\Claude\"
| where FolderPath has_any (@"\Downloads\", @"\AppData\Local\Temp\", @"\Temp\")
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemoteUrl has_any ("claude.ai.download-app.us", "downloading-api.it.com")
      or RemoteIP in ("2.24.131.246")
    | project DeviceId, NetTimestamp = Timestamp, RemoteUrl, RemoteIP
) on DeviceId
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Timestamp desc
```

### Sigma

```yaml
title: Trojanized ClaudeDesktop.exe Installer Execution from Non-Standard Path
id: 7c1e2a4a-3b1e-4f2a-9c6b-1a2b3c4d5e6f
status: experimental
description: Detects execution of a binary named ClaudeDesktop.exe or DockerDesktop.exe launched from a Downloads or Temp directory rather than the legitimate Program Files install path, consistent with the FakeAgent malvertising campaign delivering a trojanized JCEF-based installer that sideloads SectopRAT.
references:
    - https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
    - https://attack.mitre.org/techniques/T1204/002/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1566
    - attack.t1195
    - attack.execution
    - attack.t1204.002
    - attack.tool.sectoprat
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\ClaudeDesktop.exe'
            - '\DockerDesktop.exe'
    filter_legit_path:
        Image|contains: '\Program Files\Claude\'
    selection_susp_path:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Temp\'
    condition: selection_image and selection_susp_path and not filter_legit_path
falsepositives:
    - Legitimate Docker Desktop or Claude Desktop reinstall/repair executed manually from a Downloads folder
level: high
```

**Known false positives:**

- Legitimate manual reinstall of Claude Desktop or Docker Desktop launched from a Downloads folder before being moved to Program Files
- Corporate software packaging tools that stage installers in Temp before silent install

**Tuning notes:** Add an allow-list for your organization's approved software deployment tool (SCCM/Intune) staging paths; extend the domain match list with newly observed FakeAgent redirect infrastructure as Huntress/Anthropic publish updates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- libcef.dll Sideloading via Repurposed JCEF Helper Binary (FakeAgent) (locked: unlock with TL Creds)
- macOS ClickFix Terminal Lure and Gatekeeper Quarantine-Flag Removal (Atomic Stealer) (locked: unlock with TL Creds)
- Anomalous Claude Session Reuse and Usage-Quota Drain During Owner Inactivity (locked: unlock with TL Creds)
- Scheduled Task Persistence Disguised as DockerDesktop.exe (locked: unlock with TL Creds)
- SectopRAT VMProtect Payload Decryption with GPU/VM Sandbox Fingerprinting (locked: unlock with TL Creds)
- EtherHiding-Style Blockchain C2 via BSC Smart Contract Calls (locked: unlock with TL Creds)
- Browser Cookie/Credential Store Access by Non-Browser Process (Infostealer Harvest) (locked: unlock with TL Creds)
- Network Beacon to Known SectopRAT/Infostealer C2 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `2.24.131[.]246`
- Domain: `claude[.]ai[.]download-app[.]us`
- File hash: `f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Anthropic warns Claude users of infostealer malware infections](https://www.securityweek.com/anthropic-warns-claude-users-of-infostealer-malware-infections/)
- [Anthropic warns infostealer malware is hijacking Claude sessions to drain usage](https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/)
- [Anthropic locks out Claude users after infostealers hijack login sessions](https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/)
- [Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts](https://cybersecuritynews.com/hackers-steal-claude-login-sessions/)
- [Infostealers Are Hijacking Claude Sessions and Draining Subscriptions](https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions.html)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)
- [Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2](https://gbhackers.com/fake-claude-desktop-installer/)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [RedLine Stealer, Software S1240](https://attack.mitre.org/software/S1240/)
- [Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141b)
- [LummaC2 Fractures as Acreed Malware Becomes Top Dog](https://www.darkreading.com/remote-workforce/lummac2-fractures-acreed-malware-top-dog)
- [Atomic macOS stealer is mimicking an AI agent tool for Mac](https://moonlock.com/amos-mimicking-ai-agent-tool)
- [Brinztech Alert: Evolution of Atomic macOS Stealer (AMOS) - June 2026 Update](https://www.brinztech.com/breach-alerts/brinztech-alert-evolution-of-atomic-macos-stealer-amos-june-2026-update/)
- [Anthropic Warns Of Infostealers Hijacking Claude Sessions](https://thecyberexpress.com/infostealers-hijacking-claude-sessions/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2255