Some Claude subscribers found their usage limits refilling and then draining when they weren’t using the chatbot at all. Anthropic’s explanation, sent by email to affected customers last week: someone had stolen their logged-in sessions with ordinary infostealer malware and was spending their paid usage.
The company responded by signing those users out, which invalidates the stolen sessions, removing their saved payment methods and refunding charges it identified as unauthorized, SecurityWeek reported. Users have to add a card again before renewing or buying more.
Nothing about the malware was specific to Claude. “The malware identified in this campaign so far include Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on a small number of Macs,” Anthropic said in the emails, according to Help Net Security. “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the company wrote in a copy shared with The Register. “Your Claude session was likely one of the many things it collected. It appears that a bad actor has now started picking the Claude sessions out of what it collected and using them.”
Why 2FA didn’t help
Two-factor authentication protects the login step. After that, a site hands the browser a session cookie so the user doesn’t have to sign in again on every click. Infostealers copy that cookie along with saved passwords, and an attacker who replays it is treated as someone who is already logged in, with no password or second factor requested.
That’s also why Anthropic told victims that its fix only goes so far. “Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware,” the company said. Its advice was to scan for and remove the malware first, then set a new password and turn on 2FA for the email account tied to Claude.
The Reddit user who shared the email, WorriedAssociate7029, said the infection came from a cracked game and that their social media accounts had been hijacked a few days earlier. “I got fooled like a rookie by downloading a cracked game,” they wrote. “Never again.” They gave Anthropic credit for the warning, telling The Register that “measures have finally been put in place to protect AI users,” and added a reason the attacks pay: “Tokens are valuable and can be resold.”
For companies that put Claude on developer laptops, the same applies to any SaaS account: a session cookie on an infected machine is as good as a password, and revoking active sessions is part of cleaning up after any infostealer infection.
WebProNews is an iEntry Publication