Reported by 3 outlets
Infostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FA
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Infostealer Malware Steals Claude Session Cookies to Hijack Accounts and Bypass 2FA
cyberpress.org · 44d ago · August 31st, 2026
Anthropic’s Claude AI platform has become an active target for cybercriminals, with two distinct attack chains confirmed to steal credentials, hijack paid usage, and reinfect devices even after cleanup. Anthropic has begun signing out compromised accounts, stripping saved payment methods, and issuing refunds as it works to contain the damage. According to Anthropic’s advisory, infostealer families on Windows, including Vidar , Lumma (LummaC2), StealC, RedLine, and Acreed, along with Atomic Stealer on macOS, have been quietly copying saved passwords, browser cookies, and locally stored credentials from infected machines. Infostealer Malware Steals Claude Session Cookies Because these tools steal already-authenticated session cookies rather than passwords, the theft bypasses two-factor authentication and single sign-on entirely, letting attackers replay a victim’s session and burn through paid usage without ever logging in. Anthropic says it detected the pattern after noticing usage limits being refilled and then drained while account owners were inactive. A related threat tracked by Huntress as FakeAgent shows attackers weaponizing Claude’s own infrastructure. Between July 21–22, 2026, victims searching Bing for the “Claude desktop app” were served sponsored ads linking to a malicious public Claude Artifact hosted directly on claude.ai, which inherited its SSL certificate and search authority. Clicking the fake installer, disguised as ClaudeDesktop.exe, triggered DLL sideloadi
-
update from gbhackers.com
Hackers Use Infostealer Malware to Steal Claude Session Cookies and Hijack Accounts
gbhackers.com · 43d ago · August 31st, 2026
Anthropic’s Claude AI platform is currently dealing with two separate cybercrime campaigns that aim to steal account credentials, misuse paid subscriptions, and reinstall malware even after a victim believes their device has been cleaned. In response to this threat, Anthropic has started invalidating compromised sessions, removing saved payment methods, and refunding verified fraudulent charges. While […] The post Hackers Use Infostealer Malware to Steal Claude Session Cookies and Hijack Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
mentioned by securityweek.com
Anthropic Warns Claude Users of Infostealer Malware Infections
securityweek.com · 43d ago · August 31st, 2026