Claude Accounts Hijacked by Infostealer Malware — Anthropic Forces Logouts and Refunds Users
Anthropic has automatically logged out Claude users whose active sessions were stolen by infostealer malware, deleted saved payment cards on those accounts, and refunded usage charges it attributed to the stolen-session activity (Engadget). The company attributed the hijackings to malware on customers' own computers, not to a breach of Anthropic's own systems.
A threat actor used off-the-shelf infostealer malware to grab session data and access Claude accounts belonging to an unknown number of users (Dark Reading). Infostealers are a common class of malware designed to silently extract saved passwords, browser cookies, and other credentials from an infected machine. Anthropic identified six malware families as responsible: Vidar, Lumma, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs (Engadget). None of these were built specifically to target Claude; they are commodity malware already circulating widely in the broader cybercrime ecosystem.
The attack chain is straightforward session-cookie theft. When you log into a website like Claude, the server gives your browser a session cookie — a small token that acts as a "you're already logged in" pass. The infostealers grab that cookie from the infected machine. An attacker then loads the stolen cookie into their own browser, picking up the victim's session as if they had already entered the username and password. Because the session token skips the login flow entirely, no password re-entry or two-factor authentication challenge is triggered (Engadget; Malwarebytes). Anthropic warned that once inside, attackers can run up victims' usage limits, generating charges the account holder did not authorize (SecurityWeek).
Anthropic's response was proactive rather than advisory. The company forced sign-outs of the affected sessions, removed the card on file for each compromised account, and refunded the extra usage charges tied to the malicious activity (Engadget; Help Net Security; Paubox). The number of affected users has not been disclosed.
For users who suspect they were caught in the sweep, Anthropic's recommended recovery sequence is specific: remove the infostealer malware from the compromised machine before attempting to log back in, secure the account's email address with a new password and two-factor authentication, and only then re-add a payment method (Engadget). The ordering matters. Reauthenticating on a still-infected machine would simply hand the attacker a fresh session cookie.
Anthropic's help center documents the manual session-revocation path for users who want to invalidate all active logins themselves: sign in, click your initials in the lower-left corner, select Settings, then navigate to the Account section (Anthropic Support). For Claude Code users, the /logout command ends the active command-line session (Anthropic Support), and administrators can use "Sign out everywhere" in the admin console to revoke every session and enrolled device for a member who cannot sign in (Anthropic Docs).
The broader context here is that session-cookie replay is not a vulnerability in Claude's authentication design. It is a class of attack that affects virtually any web application relying on bearer-token sessions — the technical term for a session cookie that grants access simply by being presented, like a badge that opens a door without checking ID. Infostealers have been harvesting browser cookies and tokens for years across banking, email, and SaaS platforms. What is less common is a vendor detecting the downstream abuse and acting unilaterally to sever the compromised sessions, strip stored payment instruments, and issue refunds without waiting for the user to notice and file a report. That proactive posture is worth flagging because it shifts a portion of the incident-response burden from the user to the provider.
The attack surface itself is also worth noting. Claude's usage-based billing model means that a hijacked session is not merely a privacy concern but a direct financial liability for the account holder. An attacker with a valid session token can consume API credits or push a subscription past its included limits, generating real charges. Anthropic's decision to refund those charges closes the loop on that exposure, but the structural risk persists: any service where authenticated sessions translate to billable consumption is an attractive target for cookie theft, and commodity infostealers are already widely deployed to harvest exactly this kind of credential.
For organizations running Claude Code in team settings, the admin-level "Sign out everywhere" capability is the relevant control. It allows a security team to forcibly revoke a compromised member's sessions and device enrollments even if the user cannot authenticate, which is the likely scenario if an attacker has changed account details or if the user's machine is offline for remediation.
The remediation playbook is conventional: run a reputable malware scanner to identify and remove the infostealer, rotate the email account password, enable 2FA on that email, then cycle the Claude session and re-add payment methods only on a known-clean machine. The technical controls on Anthropic's side — session revocation and payment-card removal — are already in place for affected accounts. The remaining responsibility sits with the endpoint.
