Anthropic detected infostealer malware stealing Claude sessions from infected machines and draining user quotas. Stolen sessions bypass password and 2FA entirely, making authentication strength irrelevant once malware runs on your endpoint. This monetizes what was previously low-value session theft.
Anthropic detected infostealer malware stealing Claude sessions, draining user quotas. These sessions, once stolen, bypass password and 2FA entirely because they’re already authenticated. Users with locked-down security can still be compromised if malware runs on their machine.
This surfaces a structural problem. Stealing browser sessions is trivial for malware, but stolen sessions were previously low-value. Now they’re high-value: direct quota access without needing to crack passwords. Anthropic is revoking affected sessions and refunding charges, but the vulnerability persists: any endpoint compromise gives attackers full quota access.
Sources: Anthropic warns infostealer malware is hijacking Claude sessions
Related on this blog: [AUTO] Poison Claude: Discounted Access, Full Visibility • [AUTO] Newer Models Escalate Faster • [AUTO] AI-Generated Patches Fail at Scale