Threat reportMalwareTL-2026-4533
Infostealer-Driven Claude AI Session Hijacking via Stolen Browser Cookies (Vidar, LummaC2, StealC, RedLine, Acreed, AMOS)
Infostealer-Driven Claude AI Session Hijacking via Stolen (TL-2026-4533), also tracked as Claude session hijacking, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Anthropic Claude (web sessions, accounts and Claude Code OAuth tokens, maps to 8 MITRE ATT&CK techniques (T1005, T1078, T1204.002), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4533
- Threat ID
- TL-2026-4533
- Also known as
- Claude session hijacking, Claude session theft
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, professional services, general consumers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Infostealer-Driven Claude AI Session Hijacking via Stolen
Malware and tooling: AMOS, Acreed, Atomic Stealer (AMOS), LummaC2, RedLine, Stealc, Vidar
How Infostealer-Driven Claude AI Session Hijacking via Stolen works
Commodity infostealers running on user endpoints steal browser cookies, session IDs and saved credentials, letting attackers replay authenticated Claude sessions without a password or MFA prompt. Anthropic force-signed-out affected users, removed saved payment methods and refunded unauthorized charges, characterizing the issue as endpoint compromise rather than a Claude infrastructure flaw.
Between late August and early September 2026, Anthropic warned Claude users that general-purpose infostealer malware on their own devices was being used to hijack active, authenticated Claude sessions. The S-RM Cyber Intelligence Briefing of 4 September 2026 summarized the issue (sourced from a cybersecuritynews.com article) as malware stealing saved passwords, browser cookies and locally stored credentials, allowing attackers to take over active Claude sessions without passwords or MFA approval. The S-RM briefing does not name malware families; secondary reporting (eSecurityPlanet, TheCyberSecGuru, Paubox, Ecosistema Startup) states Anthropic identified Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on macOS, with fewer macOS cases.
Attack chain as reported: a malicious or untrusted download (unofficial apps, cracked or pirated software, software disguised as legitimate, a pirated game cited as an example) installs an infostealer; the stealer harvests browser data including session cookies and authentication tokens; the attacker replays the stolen session on attacker-controlled systems, impersonating the user. Because the cookie represents an already-authenticated state, the login step (and any MFA protecting it) is bypassed. No vulnerability in Anthropic infrastructure is exploited, and Anthropic stated it had no reason to believe the malware was related to Claude, installed through Claude, or caused by anything victims did while using Claude.
Impact reported: attackers consume the victim's paid usage allowance (users noticed usage limits that refilled and then drained while idle; one documented case of a UK AI consultant on a Claude Max 20x plan saw anomalous consumption on 4 August 2026 and unauthorized OAuth tokens created for Claude Code), saved payment methods were affected, and per one source stolen access is resold on underground forums at a fraction of subscription price while the legitimate owner is billed. One analysis reports stolen Claude sessions could reach connected systems through standing OAuth grants (for example corporate Gmail). One source reports web session cookies persist for 28 days of inactivity with hourly refresh, enabling weeks of reuse after theft; this and the claim that Claude lacks native MFA come from a single secondary source and are unverified.
Anthropic's response: forced sign-out of affected accounts (stopping stolen sessions), revocation of stolen tokens, removal of stored payment methods, refunds where unauthorized charges were identified, and email notification of affected users. Signing out does not remove the malware, so victims must clean the endpoint and rotate credentials of linked email accounts. The number of affected accounts has not been disclosed. No network or file IOCs were published in any source, so no BeaconBeagle correlation was possible. The S-RM briefing also covers unrelated items (Rhysida/Berlin, McKesson, AI-automated GitLab ransomware, Sality/TeamPCP, Lenovo/Dropbox, Starlink) that are out of scope for this record.
MITRE ATT&CK techniques used in TL-2026-4533
Collection
Initial Access
Execution
Impact
T1496.004 Cloud Service Hijacking
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
lateral-movement
Affected products and versions in Infostealer-Driven Claude AI Session Hijacking via Stolen
- Anthropic — Claude (web sessions, accounts and Claude Code OAuth tokens on infected endpoints)
Vulnerable versions: Accounts authenticated on endpoints infected with infostealers
Fixed in: No product patch; Anthropic forced sign-outs and token revocation for affected accounts - Microsoft — Windows (infected endpoints: Vidar, LummaC2, StealC, RedLine, Acreed)
Vulnerable versions: Endpoints running infostealer malware - Apple — macOS (infected endpoints: Atomic Stealer)
Vulnerable versions: Endpoints running Atomic Stealer
Remediation for Infostealer-Driven Claude AI Session Hijacking via Stolen
Immediate actions
- Stop using the suspected-compromised device for sensitive logins and run a full malware scan (e.g. Microsoft Defender on Windows, macOS security utilities)
- Secure the email account linked to Claude: set a new password, sign out other devices, enable fresh 2FA
- Revoke active sessions and API/OAuth tokens, including Google and browser sessions from secondary devices
- Review financial statements and re-enter payment details only after confirming the machine is clean
Workarounds
- Clean the endpoint first: signing out of Claude stops stolen sessions but does not remove the malware
Longer-term hardening
- Deploy EDR with infostealer detection on endpoints
- Implement session anomaly detection (impossible travel, device fingerprint mismatch, concurrent sessions)
- Reduce session token lifetimes and establish revocation paths independent of vendor detection
- Audit standing OAuth grants and delegated access held by AI assistants
- Block pirated/cracked software and unofficial app downloads via policy
Weaknesses (CWE) in Infostealer-Driven Claude AI Session Hijacking via Stolen
Timeline of Infostealer-Driven Claude AI Session Hijacking via Stolen
- A UK AI consultant with a Claude Max 20x account notices anomalous token consumption during inactivity and unauthorized Claude Code OAuth tokens (later reported to TechCrunch on 2026-09-08)
- eSecurityPlanet and TheCyberSecGuru report Anthropic's warning that infostealers (Vidar, LummaC2, StealC, RedLine, Acreed, AMOS) are hijacking Claude sessions; Anthropic signs affected users out, removes stored payment methods and refunds unauthorized charges
- Paubox publishes coverage noting Anthropic emailed affected users and that the number of affected accounts is undisclosed
- S-RM Cyber Intelligence Briefing summarizes the campaign: stolen passwords, cookies and local credentials let attackers hijack active Claude sessions without passwords or MFA
- Vijilan analysis published (updated 2026-10-21) describing cookie replay, anomalous-usage detection by Anthropic, and stolen sessions reaching connected systems via OAuth grants
- Ecosistema Startup reports stolen Claude access is resold on underground forums and describes the documented case reported to TechCrunch
Sources cited for Infostealer-Driven Claude AI Session Hijacking via Stolen
- S-RM Cyber Intelligence Briefing - 4 September 2026
- Anthropic Warning: Infostealer Malware Is Hijacking Claude Sessions, Draining Accounts (eSecurityPlanet)
- Anthropic Signs Claude Users Out After Infostealer Malware Steals Login Sessions and Drains AI Usage (TheCyberSecGuru)
- Infostealer malware lets hackers hijack Claude user accounts (Paubox)
- Claude session hijacking: infostealer MFA bypass (Vijilan)
- Ciberdelincuentes roban sesiones de Claude y revenden acceso (Ecosistema Startup)
Detection coverage for TL-2026-4533
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4533 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.