Beginning around August 30, 2026, Anthropic notified a subset of Claude users that commodity infostealer malware already resident on their personal machines had exfiltrated their authenticated Claude browser session cookies alongside other locally stored browser credentials, and that a threat actor had subsequently begun using those stolen sessions to access victims' Claude accounts, consume paid usage quota, and attempt to use stored payment methods. Anthropic named five Windows-targeting stealer families -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine (RedLine Stealer), and Acreed -- plus Atomic Stealer (AMOS) affecting a small number of Macs. All are mature, actively maintained malware-as-a-service (MaaS) infostealer families sold on Russian-language cybercriminal forums and dark-web marketplaces; none were purpose-built against Claude or Anthropic, and Anthropic explicitly stated it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything the victim did within Claude.

The underlying technique is session-cookie theft rather than password theft: because these infostealers copy already-authenticated browser session state (cookies, in some cases local tokens for cloud SaaS platforms) rather than only capturing typed credentials, an attacker who replays the stolen session is treated by the target service as the already-logged-in, already-2FA/SSO-verified user. This sidesteps password resets and MFA/SSO checks entirely, since those controls only gate the *establishment* of a session, not its subsequent reuse. Anthropic's own account of the detection notes it identified the pattern by observing usage limits that appeared to refill and then drain while the legitimate account owner was inactive -- an anomaly consistent with an attacker periodically returning to consume quota on hijacked accounts.

Infection in the documented cases reported alongside this disclosure was consumer-grade and opportunistic: a BleepingComputer-sourced case involved a pirated video game installer, and a separately reported case involved pirated software downloaded from a Russian-language underground forum; in the latter case, standard Windows Defender antivirus did not flag the malware. This matches the well-documented distribution tradecraft of these specific malware families, which are commonly bundled into cracked/pirated software, fake cracks and key generators, and malvertising campaigns impersonating legitimate downloads. Once resident, these stealers (per public technical analyses of the specifically named families) harvest browser-stored passwords, autofill data, and session cookies via direct access to browser credential/cookie stores (invoking Windows DPAPI/CryptUnprotectData or Firefox NSS3 decryption, or, on macOS, reading Keychain and Safari's Cookies.binarycookies), stage the harvested data locally, and exfiltrate it over HTTP(S) to attacker-controlled C2 infrastructure -- with at least one of the named families (Vidar) documented using Telegram and Steam profile pages as C2 dead-drops. The Acreed family in particular has been documented specifically targeting active session/access tokens for major cloud SaaS platforms (Microsoft 365, Google Workspace, AWS, Azure, Salesforce) to bypass MFA on enterprise identity providers, which is consistent with the same tradecraft being pointed at Claude sessions here.

Anthropic's remediation for affected accounts consisted of forcibly signing out compromised sessions, removing saved payment methods, and refunding usage charges it identified as unauthorized. Anthropic explicitly cautioned that signing a user out stops further abuse of that specific stolen session but does not remove the malware itself from the victim's machine, and directed affected users to run a full malware scan, reset their Claude password and linked email password (enabling 2FA), review payment statements, and revoke other active sessions before resuming use. Coverage of the disclosure also noted a broader enterprise exposure gap: organizations that have adopted AI SaaS tools like Claude without folding those sessions into centralized identity and access management (IAM) now have a class of high-value, long-lived session tokens sitting in employee browsers largely outside the monitoring applied to traditional corporate SaaS.

Scope and severity notes: no CVE applies -- this is a malware/technique-driven account-takeover pattern, not a Claude or Anthropic platform vulnerability. Anthropic has not disclosed the total number of affected accounts, and no campaign-specific network indicators (C2 IPs/domains, sample hashes) tied to the Claude-targeting activity have been published as of this writing; the technical indicators documented here (malware family capabilities, MITRE ATT&CK techniques, and the general distribution/C2 tradecraft of these specific families) are drawn from established public threat research on Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer rather than campaign-specific IOCs. A related but distinct campaign publicly reported the same week -- 'FakeAgent,' a fake ClaudeDesktop.exe installer distributed via Bing malvertising on July 21-22, 2026 that dropped the SectopRAT trojan and compromised roughly 29 organizations -- is explicitly out of scope for this record; it is a separate malware delivery campaign and is tracked independently.