Anthropic warned that commodity infostealers are lifting Claude session cookies from browsers and replaying them to drain paid usage. No password, no MFA prompt, and signing the user out stops the session without removing the malware.