# Infostealer-Driven Claude AI Session Hijacking via Stolen Browser Cookies (Vidar, LummaC2, StealC, RedLine, Acreed, AMOS)

> Commodity infostealers running on user endpoints steal browser cookies, session IDs and saved credentials, letting attackers replay authenticated Claude sessions without a password or MFA prompt. Anthropic force-signed-out affected users, removed saved payment methods and refunded unauthorized charges, characterizing the issue as endpoint compromise rather than a Claude infrastructure flaw.

- **Published:** 2026-10-27T11:42:53Z
- **Last reviewed:** 2026-10-27T11:42:53Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4533
- **ID:** TL-2026-4533
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between late August and early September 2026, Anthropic warned Claude users that general-purpose infostealer malware on their own devices was being used to hijack active, authenticated Claude sessions. The S-RM Cyber Intelligence Briefing of 4 September 2026 summarized the issue (sourced from a cybersecuritynews.com article) as malware stealing saved passwords, browser cookies and locally stored credentials, allowing attackers to take over active Claude sessions without passwords or MFA approval. The S-RM briefing does not name malware families; secondary reporting (eSecurityPlanet, TheCyberSecGuru, Paubox, Ecosistema Startup) states Anthropic identified Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on macOS, with fewer macOS cases.

Attack chain as reported: a malicious or untrusted download (unofficial apps, cracked or pirated software, software disguised as legitimate, a pirated game cited as an example) installs an infostealer; the stealer harvests browser data including session cookies and authentication tokens; the attacker replays the stolen session on attacker-controlled systems, impersonating the user. Because the cookie represents an already-authenticated state, the login step (and any MFA protecting it) is bypassed. No vulnerability in Anthropic infrastructure is exploited, and Anthropic stated it had no reason to believe the malware was related to Claude, installed through Claude, or caused by anything victims did while using Claude.

Impact reported: attackers consume the victim's paid usage allowance (users noticed usage limits that refilled and then drained while idle; one documented case of a UK AI consultant on a Claude Max 20x plan saw anomalous consumption on 4 August 2026 and unauthorized OAuth tokens created for Claude Code), saved payment methods were affected, and per one source stolen access is resold on underground forums at a fraction of subscription price while the legitimate owner is billed. One analysis reports stolen Claude sessions could reach connected systems through standing OAuth grants (for example corporate Gmail). One source reports web session cookies persist for 28 days of inactivity with hourly refresh, enabling weeks of reuse after theft; this and the claim that Claude lacks native MFA come from a single secondary source and are unverified.

Anthropic's response: forced sign-out of affected accounts (stopping stolen sessions), revocation of stolen tokens, removal of stored payment methods, refunds where unauthorized charges were identified, and email notification of affected users. Signing out does not remove the malware, so victims must clean the endpoint and rotate credentials of linked email accounts. The number of affected accounts has not been disclosed. No network or file IOCs were published in any source, so no BeaconBeagle correlation was possible. The S-RM briefing also covers unrelated items (Rhysida/Berlin, McKesson, AI-automated GitLab ransomware, Sality/TeamPCP, Lenovo/Dropbox, Starlink) that are out of scope for this record.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1550.004 Web Session Cookie
- T1078 Valid Accounts
- T1496.004 Cloud Service Hijacking

## Sources

- [S-RM Cyber Intelligence Briefing - 4 September 2026](https://www.s-rminform.com/cyber-intelligence-briefing/cyber-intelligence-briefing-4-september-2026)
- [Anthropic Warning: Infostealer Malware Is Hijacking Claude Sessions, Draining Accounts (eSecurityPlanet)](https://www.esecurityplanet.com/threats/news-claude-session-hijacking-infostealer-malware/)
- [Anthropic Signs Claude Users Out After Infostealer Malware Steals Login Sessions and Drains AI Usage (TheCyberSecGuru)](https://thecybersecguru.com/?p=24374)
- [Infostealer malware lets hackers hijack Claude user accounts (Paubox)](https://www.paubox.com/blog/infostealer-malware-lets-hackers-hijack-claude-user-accounts)
- [Claude session hijacking: infostealer MFA bypass (Vijilan)](https://vijilan.com/blog/claude-session-hijacking-infostealer-mfa-bypass)
- [Ciberdelincuentes roban sesiones de Claude y revenden acceso (Ecosistema Startup)](https://ecosistemastartup.com/ciberdelincuentes-roban-sesiones-de-claude-y-revenden-acceso/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4533