As reported by SecurityAffairs, Anthropic has begun forcibly signing out Claude users and removing stored payment methods after detecting that infostealer malware stole active session tokens from compromised endpoints. The attackers used those sessions to access paid accounts and burn through usage quotas — without ever needing a password or MFA code.
This is not a breach of Anthropic's infrastructure. It is a stark reminder that session cookies are the new credentials, and that MFA — however strong — only protects the login moment, not the persistent session that follows.
Why Session Hijacking Defeats MFA
The attack chain is straightforward and well-understood by threat actors. Infostealer malware running on a victim's Windows or macOS machine exfiltrates browser cookies and session tokens. Those tokens represent an already-authenticated state. When an attacker imports them into their own browser — often using tools like Cookie Editor extensions or automated session-replay frameworks — the service sees a valid, authenticated session and grants access. No password challenge. No push notification. No TOTP prompt.
MFA verifies identity at the door. Session tokens are the key that lets you stay inside. Infostealers steal the key — and most services never check whether the same key is being used from a completely different location.
Anthropic confirmed that phones and tablets were not involved, which aligns with the typical infostealer distribution model: malicious downloads, cracked software, and fake installers targeting desktop operating systems. The company also noted that the malware had likely been present on affected machines for some time before the Claude sessions were harvested and used. This latency matters.
The Reactive Response Problem
Anthropic's actions — revoking sessions, removing stored cards, refunding unauthorized charges — are appropriate and necessary. But they are fundamentally reactive. As Anthropic itself acknowledged, if the underlying malware remains on the endpoint, the next time the user logs back in, the infostealer captures the fresh session and the cycle repeats.
This creates a whack-a-mole dynamic that any SaaS provider relying on browser-based sessions faces. The provider can invalidate tokens, but they cannot remediate the victim's infected machine. That responsibility falls to the user — or, in enterprise contexts, to IT and security teams.
Broader Implications for AI Platform Security
Claude is not uniquely vulnerable. Any AI platform or SaaS application that maintains persistent browser sessions is exposed to this same attack pattern. What makes AI subscriptions particularly attractive targets is the direct monetization path: stolen sessions can be resold on dark web markets, used to generate content at scale, or leveraged to exfiltrate proprietary data the victim has uploaded into conversation context.
For organizations using Claude or similar AI tools with company accounts, the risk extends beyond subscription cost. Attackers with live session access can read previous conversations, potentially exposing sensitive business data, code snippets, or internal documents that users have shared with the AI assistant.
Shield53 Recommendations
The fundamental lesson here is not about Claude specifically. It is that the industry's reliance on long-lived browser sessions, combined with the proliferation of infostealer malware, creates a persistent access control gap that MFA cannot close. Until session-level security matures — with better device binding, anomaly detection, and shorter token lifetimes — every web-based service is playing the same reactive game Anthropic found itself in this week.
