As reported by BleepingComputer, Anthropic has begun notifying Claude users that infostealer malware — including Vidar, LummaC2, StealC, RedLine, and Atomic Stealer (AMOS) — is being used to steal authenticated browser sessions and drain account usage limits. This is not a breach of Anthropic's infrastructure. It is a endpoint-compromise problem with a novel twist: AI usage quotas are now valuable enough to harvest.
What makes this story significant is not the malware itself — these infostealers have been circulating for years — but the attacker incentive shift. Session cookies for an AI assistant with paid usage tiers represent a quietly liquid resource. A stolen Claude Pro session, or one linked to an enterprise billing account, can be resold or consumed for automated generation tasks without ever triggering a login prompt or MFA challenge. The threat actor doesn't need credentials; they need a cookie jar.
Why Session Theft Bypasses MFA
Infostealers exfiltrate browser session tokens — the persistent cookies that keep you logged in after authenticating. Because these tokens represent an already-completed authentication, traditional MFA does nothing to protect them. Anthropic correctly notes that signing users out invalidates the stolen session, but this is reactive. If the malware persists on the endpoint, the next login is immediately re-harvested.
Who Is Most at Risk
- Individual users on shared or personal devices — especially those downloading pirated software or cracks, which is the confirmed initial infection vector in at least one case.
- Small teams using Claude with shared billing — a single compromised endpoint can rack up significant usage before anomaly detection catches it.
- Enterprise environments without EDR — organizations that adopted AI tools ahead of endpoint hardening policies.
The real lesson here is broader than Claude: any SaaS platform with usage-based billing or rate-limited access is a potential target for session-cookie theft. AI platforms just happen to be the newest and most economically attractive.
Shield53 Recommendations
Immediate Actions:
- Deploy EDR/XDR on all endpoints accessing Claude or other paid AI platforms. Infostealers like LummaC2 and Vidar are well-signatured by major vendors.
- Review Claude account activity for unexpected usage spikes or quota depletion during off-hours.
- Revoke all active sessions from the Claude account settings and remove saved payment methods if any endpoint is suspected compromised.
- Run a full malware scan and, if infostealer infection is confirmed, wipe and reinstall the affected machine. Cleaning is insufficient — these stealers grab everything and you cannot verify what was exfiltrated.
- Rotate all credentials stored in the affected browser's password manager, not just Claude.
Strategic Hardening:
- Block browser session persistence for high-value accounts where feasible, or enforce session timeouts via policy.
- Restrict AI platform access to managed, hardened endpoints rather than personal devices.
- Implement network-level monitoring for unusual outbound traffic to known infostealer C2 infrastructure — threat intel feeds from vendors tracking LummaC2 and Vidar are widely available.
- Educate users on the specific risk of pirated software and cracked games as primary infostealer delivery vectors.
Anthropic's response — revoking sessions, removing payment methods, and issuing refunds — is reasonable damage control. But the root cause is endpoint hygiene, and no AI provider can remediate that for you. As AI platforms become integral to business workflows, the security of the endpoints accessing them becomes directly tied to the financial exposure of your AI spend.
