# Commodity Infostealers Hijack Authenticated Claude Sessions to Drain Usage and Payment Methods

> Anthropic disclosed that commodity infostealer malware (Vidar, LummaC2, StealC, RedLine, and Acreed on Windows; Atomic Stealer/AMOS on a small number of Macs) is harvesting authenticated Claude browser session cookies from infected consumer machines and replaying them to hijack accounts, bypassing password and 2FA/SSO checks entirely. Anthropic detected the pattern from anomalous usage-limit refill/drain cycles, began notifying affected users on August 30, 2026, and is signing out sessions, removing stored payment methods, and refunding confirmed unauthorized charges.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2257
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-commodity-infostealers-claude-sessions-tl-2026-2257.webp?v=e0454bba (Threadlinqs threat intel: Commodity Infostealers Target Claude: Detection & IOCs (TL-2026-2257) — Medium severity, 8 IOCs, 9 detection rules.)
- **ID:** TL-2026-2257
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8

## Description

Beginning around August 30, 2026, Anthropic notified a subset of Claude users that commodity infostealer malware already resident on their personal machines had exfiltrated their authenticated Claude browser session cookies alongside other locally stored browser credentials, and that a threat actor had subsequently begun using those stolen sessions to access victims' Claude accounts, consume paid usage quota, and attempt to use stored payment methods. Anthropic named five Windows-targeting stealer families -- Vidar, LummaC2 (Lumma Stealer), StealC, RedLine (RedLine Stealer), and Acreed -- plus Atomic Stealer (AMOS) affecting a small number of Macs. All are mature, actively maintained malware-as-a-service (MaaS) infostealer families sold on Russian-language cybercriminal forums and dark-web marketplaces; none were purpose-built against Claude or Anthropic, and Anthropic explicitly stated it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything the victim did within Claude.

The underlying technique is session-cookie theft rather than password theft: because these infostealers copy already-authenticated browser session state (cookies, in some cases local tokens for cloud SaaS platforms) rather than only capturing typed credentials, an attacker who replays the stolen session is treated by the target service as the already-logged-in, already-2FA/SSO-verified user. This sidesteps password resets and MFA/SSO checks entirely, since those controls only gate the *establishment* of a session, not its subsequent reuse. Anthropic's own account of the detection notes it identified the pattern by observing usage limits that appeared to refill and then drain while the legitimate account owner was inactive -- an anomaly consistent with an attacker periodically returning to consume quota on hijacked accounts.

Infection in the documented cases reported alongside this disclosure was consumer-grade and opportunistic: a BleepingComputer-sourced case involved a pirated video game installer, and a separately reported case involved pirated software downloaded from a Russian-language underground forum; in the latter case, standard Windows Defender antivirus did not flag the malware. This matches the well-documented distribution tradecraft of these specific malware families, which are commonly bundled into cracked/pirated software, fake cracks and key generators, and malvertising campaigns impersonating legitimate downloads. Once resident, these stealers (per public technical analyses of the specifically named families) harvest browser-stored passwords, autofill data, and session cookies via direct access to browser credential/cookie stores (invoking Windows DPAPI/CryptUnprotectData or Firefox NSS3 decryption, or, on macOS, reading Keychain and Safari's Cookies.binarycookies), stage the harvested data locally, and exfiltrate it over HTTP(S) to attacker-controlled C2 infrastructure -- with at least one of the named families (Vidar) documented using Telegram and Steam profile pages as C2 dead-drops. The Acreed family in particular has been documented specifically targeting active session/access tokens for major cloud SaaS platforms (Microsoft 365, Google Workspace, AWS, Azure, Salesforce) to bypass MFA on enterprise identity providers, which is consistent with the same tradecraft being pointed at Claude sessions here.

Anthropic's remediation for affected accounts consisted of forcibly signing out compromised sessions, removing saved payment methods, and refunding usage charges it identified as unauthorized. Anthropic explicitly cautioned that signing a user out stops further abuse of that specific stolen session but does not remove the malware itself from the victim's machine, and directed affected users to run a full malware scan, reset their Claude password and linked email password (enabling 2FA), review payment statements, and revoke other active sessions before resuming use. Coverage of the disclosure also noted a broader enterprise exposure gap: organizations that have adopted AI SaaS tools like Claude without folding those sessions into centralized identity and access management (IAM) now have a class of high-value, long-lived session tokens sitting in employee browsers largely outside the monitoring applied to traditional corporate SaaS.

Scope and severity notes: no CVE applies -- this is a malware/technique-driven account-takeover pattern, not a Claude or Anthropic platform vulnerability. Anthropic has not disclosed the total number of affected accounts, and no campaign-specific network indicators (C2 IPs/domains, sample hashes) tied to the Claude-targeting activity have been published as of this writing; the technical indicators documented here (malware family capabilities, MITRE ATT&CK techniques, and the general distribution/C2 tradecraft of these specific families) are drawn from established public threat research on Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer rather than campaign-specific IOCs. A related but distinct campaign publicly reported the same week -- 'FakeAgent,' a fake ClaudeDesktop.exe installer distributed via Bing malvertising on July 21-22, 2026 that dropped the SectopRAT trojan and compromised roughly 29 organizations -- is explicitly out of scope for this record; it is a separate malware delivery campaign and is tracked independently.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1550.004 Web Session Cookie
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1055.012 Process Hollowing
- T1497.001 System Checks
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Non-Browser Process Accessing Browser Cookie/Credential Stores** (`TL-2026-2257-SPL-002`)

Detects a non-browser process reading or copying browser credential/cookie database files (Chrome/Edge 'Cookies', 'Login Data', 'Local State'; Firefox 'cookies.sqlite', 'key4.db') or invoking DPAPI CryptUnprotectData against browser-owned data -- the core mechanism used by Vidar, LummaC2, StealC, RedLine, and Acreed to steal authenticated Claude session cookies per Anthropic's disclosure.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.003, T1217, T1005, T1027
- **Data sources:** sysmon, windows_security, endpoint_edr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=10)
| eval target=coalesce(TargetFilename, TargetImage)
| regex target="(?i)\\\\(Cookies|Login Data|Local State|cookies\.sqlite|key4\.db|Web Data)$"
| where NOT match(Image, "(?i)\\\\(chrome|msedge|firefox|brave|opera)\.exe$")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, target, EventCode
| where count > 0
| sort -last_seen
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName in~ ("Cookies", "Login Data", "Local State", "cookies.sqlite", "key4.db", "Web Data")
| where InitiatingProcessFileName !~ "chrome.exe" and InitiatingProcessFileName !~ "msedge.exe" and InitiatingProcessFileName !~ "firefox.exe" and InitiatingProcessFileName !~ "brave.exe"
| project Timestamp, DeviceName, AccountName=RequestAccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, ActionType
| order by Timestamp desc
```

### Sigma

```yaml
title: Non-Browser Process Accessing Browser Cookie or Credential Store Files
id: 3a1d9e77-5c2f-4b6a-8e91-4d0a7f2c9b34
status: experimental
description: Detects a process other than a known browser binary reading or copying browser cookie/credential database files, consistent with infostealer session-cookie theft (Vidar, LummaC2, StealC, RedLine, Acreed) targeting authenticated Claude browser sessions.
references:
    - https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/31
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1217
    - attack.t1005
    - attack.tool.vidar
    - attack.tool.stealc
    - attack.tool.redline
logsource:
    category: file_event
    product: windows
detection:
    selection_target:
        TargetFilename|endswith:
            - '\Cookies'
            - '\Login Data'
            - '\Local State'
            - '\cookies.sqlite'
            - '\key4.db'
            - '\Web Data'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection_target and not filter_browser
falsepositives:
    - Endpoint backup/EDR agents that legitimately index browser profile directories
    - Browser sync/migration utilities run by IT during device provisioning
level: high
```

**Known false positives:**

- Backup/sync agents and enterprise EDR tooling that index browser profile folders as part of normal operation
- IT-managed profile-migration utilities

**Tuning notes:** Allowlist known backup/EDR/profile-migration process hashes and vendor install paths; raise severity when the accessing process also has no valid code signature or was recently dropped to Temp/Downloads.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake/Cracked Installer Execution Followed by Sandbox-Evasion Fingerprinting (locked: unlock with TL Creds)
- Process Hollowing into Browser Process for Cookie/Master-Key Decryption (locked: unlock with TL Creds)
- Outbound Connection to Known Infostealer Dead-Drop / C2 Infrastructure (locked: unlock with TL Creds)
- Suspicious Cracked-Software or Fake-Installer Execution (locked: unlock with TL Creds)
- Non-Browser Process Accessing Browser Cookie or Credential Store Files (locked: unlock with TL Creds)
- Connection to Known Infostealer Dead-Drop or C2 Infrastructure (locked: unlock with TL Creds)
- Cracked Software / Fake Installer Execution Preceding Infostealer Activity (locked: unlock with TL Creds)
- Hijacked Claude/SaaS Session Reuse and Anomalous Usage-Quota Refill/Drain Pattern (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Anthropic warns infostealer malware is hijacking Claude sessions to drain usage](https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/)
- [Infostealers Are Hijacking Claude Sessions and Draining Subscriptions](https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions.html)
- [Anthropic locks out Claude users after infostealers hijack login sessions](https://www.helpnetsecurity.com/2026/08/31/claude-accounts-compromised-through-infostealer/)
- [Hackers Steal Claude Login Sessions With Infostealer Malware to Hijack Accounts](https://cybersecuritynews.com/hackers-steal-claude-login-sessions/)
- [Anthropic Warns Of Infostealers Hijacking Claude Sessions](https://thecyberexpress.com/infostealers-hijacking-claude-sessions/)
- [Anthropic Warns Hackers Are Stealing Claude Sessions To Hijack Accounts](https://www.searchenginejournal.com/anthropic-warns-hackers-are-stealing-claude-sessions-to-hijack-accounts/587566/)
- [Lumma Stealer, Software S1213](https://attack.mitre.org/software/S1213/)
- [RedLine Stealer, Software S1240](https://attack.mitre.org/software/S1240/)
- [Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation](https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/)
- [What is Acreed Infostealer? The Rise of Acreed](https://www.bitsight.com/blog/the-rise-of-acreed-infostealer)
- [Lumma Persists and Acreed Rises Following Law Enforcement Actions](https://blog.lastpass.com/posts/lumma-persists-and-acreed-rises)
- [LummaC2 Fractures as Acreed Malware Becomes Top Dog](https://www.darkreading.com/remote-workforce/lummac2-fractures-acreed-malware-top-dog)
- [Stealc Malware Technical Analysis Report](https://brandefense.io/blog/stealc-malware-analysis-report/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2257