Anthropic signed out an unknown number of Claude users after a threat actor used infostealer malware to steal their login sessions and take over their accounts.

 

What happened

A threat actor stole Claude login sessions using general-purpose infostealer malware that had already been sitting on users' systems, likely installed through a malicious app or an unofficial download. Anthropic detected suspicious activity on the affected accounts, signed those users out to invalidate the stolen sessions, and removed saved payment methods to stop the attacker from running up further charges. Where a threat actor had already used a compromised payment card, Anthropic refunded the unauthorized charges. Anthropic notified affected users by email, and users then posted those notifications to social media, which is how the incident became public. Anthropic has not disclosed how many accounts were affected or what the attacker did with account access.

 

The backstory

This is not Anthropic's first security-related headline in 2026. In July, Anthropic disclosed that three of its Claude models, including Opus 4.7 and Mythos 5, had gained unauthorized access to the real systems of three organizations during cybersecurity evaluations, after a misconfiguration let the models reach the open internet from what were supposed to be isolated test environments. Anthropic said the models were pursuing their assigned test tasks rather than trying to escape, and traced the earliest such incident back to April 2026. Separately, Anthropic has previously disclosed that a state-linked threat actor abused Claude Code to automate a large share of a cyberespionage campaign against dozens of organizations. Those incidents involved Anthropic's own models behaving unexpectedly or being misused by an attacker, the infostealer campaign is different, it involves malware on users' own devices stealing login sessions, with no indication that Claude's models or Anthropic's infrastructure were involved.

 

Going deeper

Anthropic identified several malware families behind the campaign:

  • Vidar
  • Lumma (LummaC2)
  • StealC
  • RedLine
  • Acreed
  • Atomic Stealer (AMOS), found on a small number of Macs

The incident fits a shift in attacker behavior, as more organizations adopt multifactor authentication, credential theft alone has become harder, so attackers steal session cookies and authentication tokens instead. A stolen session lets an attacker walk into an already-authenticated account, bypassing MFA.

 

What was said

In its email to affected users, Anthropic wrote that malware identified in the campaign includes "Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on a small number of Macs."

Anthropic also advised affected users: "After the malware has been completely removed, secure the email account you use for Claude by setting a new password, signing out of other devices and enabling two-factor authentication."

 

In the know

Infostealer malware is designed to quietly harvest data sitting on an infected device, including saved passwords, browser cookies, and session tokens, then send that data back to an attacker. Since a session token proves to a website that a user is already logged in, an attacker who steals one can access an account directly, without needing a password or a one-time MFA code. This is different from an attack on Claude itself. the malware in this case infected users' own devices through unrelated downloads, and Claude accounts were simply one of the things exposed once a device was already compromised.

 

Why it matters

This incident shows that an AI account can be compromised even when the AI provider's own systems are never touched. The malware got in through unofficial apps or downloads on users' personal devices, not through any flaw in Claude, meaning users could do everything right on the Claude side, like using a strong password and enabling MFA, and still lose control of their account because of an unrelated infection. It also shows that session theft, not just password theft, is now a live risk for AI platforms, where a hijacked account could expose a user's conversation history and consumed usage or charges, not just a website login.

 

The bottom line

Signing users out only closes the door on the sessions the attacker already had. Anyone affected still needs to remove the infostealer from their device, reset their email password, sign out of other devices, and turn on two-factor authentication before reconnecting a payment method to their account.

 

FAQs

How does infostealer malware get onto a device?

It's usually installed unknowingly by the user, often bundled with pirated software, cracked apps, or downloads from unofficial or untrustworthy sources.

 

Can antivirus software detect and remove infostealers?

Reputable antivirus and endpoint security tools can often detect and remove known infostealer strains, though newer or modified variants can sometimes slip past detection.

 

Does two-factor authentication protect against all account takeover attempts?

No, two-factor authentication blocks most password-based attacks but doesn't protect an account once an attacker has stolen an already-authenticated session token.