Infostealer malware hijacks Claude sessions
Malware Activity
Summary
Hide ▲
Show ▼
Anthropic warned that infostealer malware is stealing Claude login sessions from infected PCs, letting attackers reuse them for account access and consumption of usage. The company is signing out affected users, removing saved payment methods, and refunding charges it identifies as unauthorized. Anthropic tied the activity to Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer (AMOS), with infections likely arriving through downloads or malicious apps.
Related Happenings
Claude infostealer session-hijack campaign
Campaign
H score38
First: 31.08.2026 15:11
Last: 31.08.2026 15:11
Sources 1
About this happening:
A campaign is abusing stolen Claude sessions to enter affected accounts, drain usage limits, and force protective sign-outs. Anthropic says the session material came from...
Claude infostealer session-hijack campaign
CampaignAbout this happening: A campaign is abusing stolen Claude sessions to enter affected accounts, drain usage limits, and force protective sign-outs. Anthropic says the session material came from...
SectopRAT fake Claude installer delivery
Malware Activity
H score19
First: 23.07.2026 22:48
Last: 23.07.2026 22:48
Sources 1
About this happening:
The SectopRAT malware is being delivered through a fake Claude desktop installer, exposing at least 29 organizations to credential theft and remote hands-on control. T...
SectopRAT fake Claude installer delivery
Malware ActivityAbout this happening: The SectopRAT malware is being delivered through a fake Claude desktop installer, exposing at least 29 organizations to credential theft and remote hands-on control. T...
FakeAgent Bing malvertising campaign pushing fake Claude installer
Campaign
H score25
First: 23.07.2026 22:48
Last: 23.07.2026 22:48
Sources 1
About this happening:
The FakeAgent campaign used Bing search ads and a malicious Claude Artifact on Claude.ai to push a fake Claude desktop app installer that delivered SectopRAT...
FakeAgent Bing malvertising campaign pushing fake Claude installer
CampaignAbout this happening: The FakeAgent campaign used Bing search ads and a malicious Claude Artifact on Claude.ai to push a fake Claude desktop app installer that delivered SectopRAT...
Openew[.]app cloaked malware download portal
Malware Activity
H score26
First: 29.05.2026 21:21
Last: 29.05.2026 21:21
Sources 1
About this happening:
The openew[.]app malware-delivery activity now also uses legitimate ChatGPT shared pages as the first lure, with Google ads and SEO poisoning sending victims to a...
Openew[.]app cloaked malware download portal
Malware ActivityAbout this happening: The openew[.]app malware-delivery activity now also uses legitimate ChatGPT shared pages as the first lure, with Google ads and SEO poisoning sending victims to a...
Timeline
-
30.08.2026 17:30 2 articles · 13d ago
Anthropic warns that infostealer malware is stealing Claude login sessions
Initial DisclosureAnthropic warned some Claude users that infostealer malware on their PCs stole active Claude login sessions, letting attackers access accounts and consume usage. The company said it is signing affected users out of Claude, removing saved payment methods, refunding charges it identifies as unauthorized, and urging users to change credentials, revoke other sessions, and remove the malware. Anthropic linked the activity to Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer (AMOS), and said the malware can arrive through downloads or malicious apps and steal browser passwords, login cookies, and other credentials.
Show sources
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage — www.bleepingcomputer.com — 30.08.2026 17:30
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage — www.bleepingcomputer.com — 30.08.2026 17:30