Claude sessions stolen by infostealers: MFA won't help

Anthropic notified affected Claude users this weekend that a bad actor is using off-the-shelf infostealer malware to lift active Claude login sessions off people's computers, then spending those accounts' usage. The company is signing affected users out, removing saved payment methods, and refunding charges it identifies as unauthorized. The part worth your attention is not the AI vendor in the headline. It is the attack: stolen session cookies skip the password and skip the MFA prompt, and the same theft applies to every SaaS tab your team leaves open.

What actually happened

Per BleepingComputer's reporting on the notice Anthropic emailed to affected users, the company said it "recently became aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers."

The details:

• The malware is generic, not Claude-specific. Named families include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs. These are commodity stealers sold as a service.
• Delivery is the usual route — pirated downloads and malicious apps. Once resident, they scrape locally stored browser passwords, cookies, and credentials for whatever else is signed in.
• Anthropic was explicit that it has no reason to believe the malware is related to Claude, installed through Claude, or connected to anything users did with Claude.
• The tell was billing-shaped: usage limits that looked like they refilled and then drained while the account owner wasn't working.
• Anthropic's remediation — revoking sessions, pulling saved payment methods, refunding — kills the stolen cookie, because signing out cancels that session everywhere.

Signing out does not remove the malware. If the box stays infected, the next login gets stolen too.

Why session theft matters for your business

Most small teams treat MFA as the finish line. It isn't. MFA protects the login event. A session cookie is what the server hands you after that event — proof you already passed. Steal it and paste it into a fresh browser, and the attacker is inside with no password, no code, no push notification, no anomaly for you to notice.

That changes what you actually have to control:

Session lifetime is a security setting. Ask, per vendor, how long a session lives and whether you can shorten it. A 90-day remembered session on an admin account is a 90-day bearer token sitting in a cookie jar.

"Sign out everywhere" is your incident response button. Find it in every tool your team uses — Google Workspace, Shopify, Stripe, your AI vendors, your CRM — before you need it. Write the list down. When a laptop is suspected compromised, revoking sessions comes before the password reset, not after.

Saved payment methods are blast radius. Anthropic wiped them for a reason. Every stored card on a hijackable account is a spending limit you did not set.

The endpoint is still the whole game. Stealers land through pirated software and sketchy installers on machines your staff also use for work. Personal-device access to business SaaS is where this starts.

Finally: watch usage curves as a security signal, not just a cost line. The first evidence here was a bill behaving oddly. If nobody reconciles token spend to actual work, an intruder gets to be quiet.

Sources: BleepingComputer, Search Engine Journal.