Skip to navigation

Threat reportMalwareTL-2026-2257

Commodity Infostealers Hijack Authenticated Claude Sessions to Drain Usage and Payment Methods

mediumACTIVE

Anthropic disclosed that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, and Acreed on Windows; Atomic Stealer/AMOS on a small number of Macs) is harvesting authenticated Claude browser session cookies from infected consumer machines and replaying them to hijack accounts, bypassing password and 2FA/SSO checks entirely.

Key facts for Commodity infostealers Claude sessions

IdentifiersTL-2026-2257
SeverityMEDIUM
Exploitation statusExploited in the wild
Affected productsAnthropic Claude (claude.ai authenticated browser sessions)
MalwareAMOS, Acreed, Atomic Stealer, Lumma Stealer - S1213, LummaC2, RedLine Stealer - S1240, Stealc, Vidar
ToolsRussian Market, pkr_ce1a packer
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1036 Masquerading, T1055.012 Process Hollowing, T1071.001 Web Protocols, T1074.001 Local Data Staging, T1082 System Information Discovery, T1204.002 Malicious File, T1217 Browser Information Discovery, T1497.001 System Checks, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie and 3 more in the attack flow
MotivationFINANCIAL
Target sectorscross-sector opportunistic individual end users and employees
Target regionsGlobal
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for Commodity infostealers Claude sessions

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2257 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Non-Browser Process Accessing Browser Cookie/Credential Stores

Detects a non-browser process reading or copying browser credential/cookie database files (Chrome/Edge 'Cookies', 'Login Data', 'Local State'; Firefox 'cookies.sqlite', 'key4.db') or invoking DPAPI CryptUnprotectData against browser-owned data -- the core mechanism used by Vidar, LummaC2, StealC, RedLine, and Acreed to steal authenticated Claude session cookies per Anthropic's disclosure.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1555.003, T1217, T1005, T1027
  • Data sources: sysmon, windows_security, endpoint_edr
  • Severity: high
  • Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=10)
| eval target=coalesce(TargetFilename, TargetImage)
| regex target="(?i)\\\\(Cookies|Login Data|Local State|cookies\.sqlite|key4\.db|Web Data)$"
| where NOT match(Image, "(?i)\\\\(chrome|msedge|firefox|brave|opera)\.exe$")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, target, EventCode
| where count > 0
| sort -last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Cookies", "Login Data", "Local State", "cookies.sqlite", "key4.db", "Web Data")
| where InitiatingProcessFileName !~ "chrome.exe" and InitiatingProcessFileName !~ "msedge.exe" and InitiatingProcessFileName !~ "firefox.exe" and InitiatingProcessFileName !~ "brave.exe"
| project Timestamp, DeviceName, AccountName=RequestAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ActionType
| order by Timestamp desc

Sigma

title: Non-Browser Process Accessing Browser Cookie or Credential Store Files
id: 3a1d9e77-5c2f-4b6a-8e91-4d0a7f2c9b34
status: experimental
description: Detects a process other than a known browser binary reading or copying browser cookie/credential database files, consistent with infostealer session-cookie theft (Vidar, LummaC2, StealC, RedLine, Acreed) targeting authenticated Claude browser sessions.
references:
    - https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/31
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1217
    - attack.t1005
    - attack.tool.vidar
    - attack.tool.stealc
    - attack.tool.redline
logsource:
    category: file_event
    product: windows
detection:
    selection_target:
        TargetFilename|endswith:
            - '\Cookies'
            - '\Login Data'
            - '\Local State'
            - '\cookies.sqlite'
            - '\key4.db'
            - '\Web Data'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_target and not filter_browser
falsepositives:
    - Endpoint backup/EDR agents that legitimately index browser profile directories
    - Browser sync/migration utilities run by IT during device provisioning
level: high

Known false positives:

  • Backup/sync agents and enterprise EDR tooling that index browser profile folders as part of normal operation
  • IT-managed profile-migration utilities

Tuning notes: Allowlist known backup/EDR/profile-migration process hashes and vendor install paths; raise severity when the accessing process also has no valid code signature or was recently dropped to Temp/Downloads.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Fake/Cracked Installer Execution Followed by Sandbox-Evasion Fingerprinting · unlock with TL Creds
  • Process Hollowing into Browser Process for Cookie/Master-Key Decryption · unlock with TL Creds
  • Outbound Connection to Known Infostealer Dead-Drop / C2 Infrastructure · unlock with TL Creds
  • Suspicious Cracked-Software or Fake-Installer Execution · unlock with TL Creds
  • Non-Browser Process Accessing Browser Cookie or Credential Store Files · unlock with TL Creds
  • Connection to Known Infostealer Dead-Drop or C2 Infrastructure · unlock with TL Creds
  • Cracked Software / Fake Installer Execution Preceding Infostealer Activity · unlock with TL Creds
  • Hijacked Claude/SaaS Session Reuse and Anomalous Usage-Quota Refill/Drain Pattern · unlock with TL Creds

Indicators of compromise for Commodity infostealers Claude sessions

As of 2026-08-31, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-2257.

8 indicators of compromise · unlock with TL Creds. Compare plans

How Commodity infostealers Claude sessions works

Anthropic detected the pattern from anomalous usage-limit refill/drain cycles, began notifying affected users on August 30, 2026, and is signing out sessions, removing stored payment methods, and refunding confirmed unauthorized charges.

Beginning around August 30, 2026, Anthropic notified a subset of Claude users that commodity infostealer malware already resident on their personal machines had exfiltrated their authenticated Claude browser session cookies alongside other locally stored browser credentials, and that a threat actor had subsequently begun using those stolen sessions to access victims' Claude accounts, consume paid usage quota, and attempt to use stored payment methods. Anthropic named five Windows-targeting stealer families -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine (RedLine Stealer), and Acreed -- plus Atomic Stealer (AMOS) affecting a small number of Macs. All are mature, actively maintained malware-as-a-service (MaaS) infostealer families sold on Russian-language cybercriminal forums and dark-web marketplaces; none were purpose-built against Claude or Anthropic, and Anthropic explicitly stated it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything the victim did within Claude.

The underlying technique is session-cookie theft rather than password theft: because these infostealers copy already-authenticated browser session state (cookies, in some cases local tokens for cloud SaaS platforms) rather than only capturing typed credentials, an attacker who replays the stolen session is treated by the target service as the already-logged-in, already-2FA/SSO-verified user. This sidesteps password resets and MFA/SSO checks entirely, since those controls only gate the *establishment* of a session, not its subsequent reuse. Anthropic's own account of the detection notes it identified the pattern by observing usage limits that appeared to refill and then drain while the legitimate account owner was inactive -- an anomaly consistent with an attacker periodically returning to consume quota on hijacked accounts.

Infection in the documented cases reported alongside this disclosure was consumer-grade and opportunistic: a BleepingComputer-sourced case involved a pirated video game installer, and a separately reported case involved pirated software downloaded from a Russian-language underground forum; in the latter case, standard Windows Defender antivirus did not flag the malware. This matches the well-documented distribution tradecraft of these specific malware families, which are commonly bundled into cracked/pirated software, fake cracks and key generators, and malvertising campaigns impersonating legitimate downloads. Once resident, these stealers (per public technical analyses of the specifically named families) harvest browser-stored passwords, autofill data, and session cookies via direct access to browser credential/cookie stores (invoking Windows DPAPI/CryptUnprotectData or Firefox NSS3 decryption, or, on macOS, reading Keychain and Safari's Cookies.binarycookies), stage the harvested data locally, and exfiltrate it over HTTP(S) to attacker-controlled C2 infrastructure -- with at least one of the named families (Vidar) documented using Telegram and Steam profile pages as C2 dead-drops. The Acreed family in particular has been documented specifically targeting active session/access tokens for major cloud SaaS platforms (Microsoft 365, Google Workspace, AWS, Azure, Salesforce) to bypass MFA on enterprise identity providers, which is consistent with the same tradecraft being pointed at Claude sessions here.

Anthropic's remediation for affected accounts consisted of forcibly signing out compromised sessions, removing saved payment methods, and refunding usage charges it identified as unauthorized. Anthropic explicitly cautioned that signing a user out stops further abuse of that specific stolen session but does not remove the malware itself from the victim's machine, and directed affected users to run a full malware scan, reset their Claude password and linked email password (enabling 2FA), review payment statements, and revoke other active sessions before resuming use. Coverage of the disclosure also noted a broader enterprise exposure gap: organizations that have adopted AI SaaS tools like Claude without folding those sessions into centralized identity and access management (IAM) now have a class of high-value, long-lived session tokens sitting in employee browsers largely outside the monitoring applied to traditional corporate SaaS.

Scope and severity notes: no CVE applies -- this is a malware/technique-driven account-takeover pattern, not a Claude or Anthropic platform vulnerability. Anthropic has not disclosed the total number of affected accounts, and no campaign-specific network indicators (C2 IPs/domains, sample hashes) tied to the Claude-targeting activity have been published as of this writing; the technical indicators documented here (malware family capabilities, MITRE ATT&CK techniques, and the general distribution/C2 tradecraft of these specific families) are drawn from established public threat research on Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer rather than campaign-specific IOCs. A related but distinct campaign publicly reported the same week -- 'FakeAgent,' a fake ClaudeDesktop.exe installer distributed via Bing malvertising on July 21-22, 2026 that dropped the SectopRAT trojan and compromised roughly 29 organizations -- is explicitly out of scope for this record; it is a separate malware delivery campaign and is tracked independently.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1074.001 Local Data Staging

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Hollowing; T1497.001 System Checks

Command and Control

T1071.001 Web Protocols

Discovery

T1082 System Information Discovery; T1217 Browser Information Discovery

Execution

T1204.002 Malicious File

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

lateral-movement

T1550.004 Web Session Cookie

Impact

T1657 Financial Theft

Remediation for Commodity infostealers Claude sessions

Immediate actions

  • Run a full anti-malware scan on any device used to access Claude and remove the infostealer before signing back in; standard signature AV (e.g. Windows Defender) reportedly missed the malware in at least one documented case, so a dedicated malware-removal/EDR scan is recommended
  • Reset the Claude account password and the password of any linked email account, and (re-)enable 2FA on both after the device is confirmed clean
  • Review recent Claude billing and usage history for unauthorized charges or unexplained quota consumption and report it to Anthropic support
  • Revoke/sign out all other active sessions for the account and re-authenticate only from a verified clean device
  • Treat any browser-saved passwords or autofill data on the infected machine as compromised and rotate those credentials

Workarounds

  • Consider a full OS reinstall on confirmed-infected machines given the anti-forensic and persistence techniques documented in these stealer families
  • Where feasible, shorten Claude (and other AI SaaS) session/cookie lifetimes and require periodic re-authentication to reduce the value of a stolen long-lived session

Longer-term hardening

  • Bring AI SaaS session tokens (Claude and similar tools) under enterprise identity and access management / SSO session monitoring rather than leaving them purely in local browser storage, closing the IAM visibility gap noted in coverage of this incident
  • Deploy EDR with behavioral detection capable of catching commodity infostealers that signature-based antivirus misses
  • Monitor for anomalous usage patterns (quota appearing to refill and then drain while the account owner is inactive) as an account-compromise indicator
  • User education against downloading pirated/cracked software, unofficial key generators, and unofficial app installers -- the primary documented infection vector for these malware families

Affected and fixed versions

  • Anthropic — Claude (claude.ai authenticated browser sessions)
    Vulnerable versions: Any authenticated claude.ai browser session cookie present on a Windows or macOS machine infected with the named infostealer families
    Fixed in: Not applicable -- not a product vulnerability; Anthropic mitigates per-account via session revocation, payment-method removal, and refunds after detecting compromise

Timeline of Commodity infostealers Claude sessions

  • locked-ioc-5 (Lumma Stealer) first appears for sale as a subscription malware-as-a-service infostealer on Russian-language cybercriminal forums (exact date within 2022 not published).
  • locked-ioc-7 infostealer is first detected in the wild, later rising to replace locked-ioc-5 as a dominant credential-theft tool on dark-web marketplaces such as locked-ioc-4.
  • A global law enforcement operation takes down locked-ioc-5 infrastructure, seizing over 2,300 domains, accelerating criminal migration to successor stealers including locked-ioc-7 (May 2025).
  • BleepingComputer publishes the first widely-cited report on the campaign, naming locked-ioc-8, locked-ioc-5, locked-ioc-6, RedLine, locked-ioc-7, and locked-ioc-3 as the malware families involved.
  • Anthropic begins emailing affected Claude users, signing out compromised sessions, removing saved payment methods from affected accounts, and refunding charges it identifies as unauthorized.
  • Anthropic identifies an anomalous usage pattern -- Claude usage limits appearing to refill and then drain while account owners are inactive -- and traces it to hijacked sessions stolen by commodity infostealer malware.
  • Help Net Security, TheCyberExpress, CyberSecurityNews, and SearchEngineJournal publish further corroborating coverage, adding Anthropic's direct quotes and the enterprise IAM-gap analysis.
  • Security Affairs publishes independent corroborating coverage of Anthropic's disclosure and the named infostealer families.

Sources cited for Commodity infostealers Claude sessions

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats