Infostealers are draining Claude subscriptions with stolen session cookies, no password needed

Anthropic warned on August 30, 2026 that commodity infostealer malware running on users' own machines is extracting stored browser cookies and session identifiers for Claude accounts, then replaying them to consume paid usage. Because a session cookie represents an already-authenticated state, the attacker never sees a password and never meets an MFA prompt. Named families include Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer. Anthropic detected the abuse through unusual usage patterns, forced logouts, removed payment methods, and issued refunds. Its guidance to affected users is to change credentials, revoke active sessions, and clean the machine, with the pointed caveat that signing out of Claude stops the stolen session but does not remove the malware.

Why it matters

This is session cookie theft with a new billing target, and the mechanics are identical to every infostealer campaign of the last three years. What is worth noticing is which control failed: none of them, in the sense that authentication worked correctly and then stopped being consulted. A bearer cookie is valid wherever it is presented, so the security of the account reduces to the security of the endpoint holding it.

Anthropic's caveat is the part to carry into your own incident process. Revoking sessions is remediation of the symptom; the infected machine re-harvests the next session the moment the user signs back in. That makes endpoint cleanup a precondition for credential rotation, not a follow-up to it, which is the reverse of how most runbooks are ordered.

The durable control is binding the session to something the malware cannot copy. Token binding, device-bound sessions, and continuous access evaluation all attack the replay rather than the theft, which matters because the theft is not preventable from the service side. Anthropic's own detection path, anomalous usage rather than anomalous login, is also the right lesson for anyone defending an AI subscription: the sign-in looked fine, because it was.

Source: BleepingComputer