As reported by Dark Reading, a threat actor has leveraged multiple infostealer malware families to harvest session tokens from Anthropic's Claude users, granting unauthorized access to accounts without needing passwords or MFA codes. This is not a breach of Anthropic's infrastructure — it is a stark illustration of how the modern authentication perimeter has shifted to the endpoint browser.

Threat Alert: As reported by Dark Reading, a threat actor has leveraged multiple infostealer malware families to harvest session tokens from Anthropic's Claude users, granting unauthorized access to accounts without needing passwords or MFA codes.

Why Session Token Theft Outpaces Traditional Credential Theft

Infostealers like Lumma, RedLine, and Raccoon have evolved beyond harvesting usernames and passwords. They now exfiltrate browser cookies and localStorage data — the actual session tokens that web applications use to maintain authenticated state. This matters because even accounts protected by strong passwords and hardware MFA can be fully compromised if the attacker obtains a valid session cookie. The MFA challenge has already been solved by the legitimate user; the token is the authentication.

The attacker doesn't need to defeat your MFA — they just need to copy the cookie that proves you already did.

For AI platforms like Claude, which often handle proprietary code, internal documents, strategic plans, and sensitive conversations, session theft represents a significant data exposure risk. Attackers gain access to conversation history, custom instructions, and any data users have uploaded — all without triggering authentication alerts.

Who Is Most at Risk

Why Session Token Theft Outpaces Traditional Credential Theft
Enterprise teams using Claude for code review or document analysis — proprietary source code and internal documents may be exposed in conversation history
Users on shared or poorly managed endpoints — unmanaged BYOD devices lack the endpoint controls needed to detect or prevent infostealer infections
Developers and technical staff — frequent targets of stealer campaigns via fake software downloads, cracked tools, and malicious npm/PyPI packages
Organizations without session management policies — long-lived session tokens with no rotation or concurrent-session limits amplify exposure

The Broader Implications for SaaS Security

This incident underscores a systemic problem: SaaS providers have largely offloaded authentication security to the browser without giving organizations adequate tools to manage session token lifecycle. Most major platforms — not just Anthropic — issue long-lived session cookies that remain valid for days or weeks. There is no standard mechanism for administrators to force global session revocation, detect anomalous session usage, or enforce device posture checks on web sessions.

The industry needs to move toward continuous session validation — re-checking device trust, geolocation, and behavioral signals throughout a session's lifetime, not just at login. Until that happens, session token theft will remain one of the highest-ROI attacks for threat actors targeting SaaS applications.

Shield53 Recommendations

Immediate Actions

  • Force session revocation — instruct affected users to log out of all Claude sessions and log back in, which invalidates stolen tokens. Anthropic provides a session management page in account settings.
  • Run endpoint scans — use EDR tools to sweep for known infostealer indicators of compromise. Focus on Lumma, RedLine, Raccoon, Stealc, and MetaStealer signatures.
  • Review Claude conversation history — check for unauthorized access by reviewing recent chats and API usage logs for anomalies.

Hardening Measures

  • Deploy browser security extensions — tools like Chrome Enterprise policies or dedicated browser security platforms can detect and block cookie exfiltration attempts.
  • Implement enterprise browser or isolation — solutions like Menlo, Cloudflare Browser Isolation, or managed Chrome environments keep session tokens server-side, away from endpoint-resident malware.
  • Enforce shorter session lifetimes — where platforms allow it, configure aggressive session timeout policies. For Claude specifically, advocate with Anthropic for configurable session duration controls.
  • Tighten endpoint controls — application allow-listing, restricted download permissions, and email filtering for executable attachments reduce infostealer infection vectors.
  • Monitor for stealer logs in dark web markets — threat intelligence services that index stealer log data can alert you when your organization's credentials or tokens appear for sale.

Strategic Recommendations

  • Classify AI platform sessions as privileged access — apply the same governance to Claude, ChatGPT, and similar tools that you would for any system handling sensitive data.
  • Build session token theft into your threat model — assume MFA alone is insufficient for any web-based SaaS application and design compensating controls accordingly.
  • Establish AI usage policies — ensure users understand what data is appropriate to share with AI tools and what the exposure risk is if their session is compromised.