Anthropic has begun emailing Claude subscribers to warn that infostealer malware running on their own computers has lifted active Claude login sessions, letting attackers sign in and burn through paid usage limits without ever touching a password or a second factor. The company is signing affected users out, invalidating authorizations, removing saved payment methods and refunding charges it identifies as unauthorized.
Key takeaways
- Anthropic named Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs, as the malware families harvesting Claude sessions.
- Stolen session cookies represent an already-authenticated state, so attackers bypass multi-factor authentication entirely.
- Claude's account tooling tracks total usage but not itemized usage, which means theft can run undetected for weeks.
How one consultant found the drain
On August 4, Grant De Swardt, an independent AI consultant in East Sussex, noticed his Claude Max 20x allowance climbing on a day he had not worked. He spent the next day disconnecting everything attached to the account and still watched consumption rise from 45% to 55% with no scheduled tasks running, no cloud execution enabled and no active local session of his own, he told TechCrunch.
When he asked Anthropic for an itemized breakdown, the company could not supply one but agreed something was wrong. It suspended his $200-per-month account, invalidated every session and server-side Claude Code credential, and refunded Β£44.49 for the unused term. Anthropic later told him a compromised session key had been used to mint unauthorized Claude Code OAuth tokens, and that the account appeared to have been serving activity for other people through an outside service it could not identify.
The suspension cost him two weeks of business. De Swardt builds agent workflows for small and mid-size firms β pulling purchase-order data out of email into accounting software, for instance β and runs his own admin, design and coding through the same tools. He has since cancelled Claude in favour of Cursor and its multi-model options, saying he saw no way to protect himself while Anthropic offers no visibility into what consumes a subscriber's tokens.
What Anthropic told affected users
The warning email, shared by recipients on Reddit, says the company became aware of a bad actor using common infostealer malware to steal Claude login sessions from people's computers and then using those sessions to consume account usage. Anthropic flagged the telltale symptom directly: limits that appear to refill and then drain while the subscriber is not using Claude.
The company was firm that the infection route has nothing to do with its own product, stating it has no reason to believe the malware is related to Claude, installed through Claude, or connected to anything users did with Claude. Infostealers typically arrive through pirated downloads or malicious apps and scrape whatever is stored locally β browser passwords, cookies, credentials for unrelated services. One Redditor who received the email confirmed installing a pirated game. As BleepingComputer reported, Anthropic also warned that signing a user out stops the stolen session but does not remove the malware, leaving the next login just as exposed.
Why session theft is hard for subscribers to catch
Because account support tracks aggregate consumption rather than per-request detail, a subscriber has no way to distinguish their own agent runs from someone else's. That gap is what turned a straightforward credential-theft campaign into a metering problem. Users posting on Reddit and GitHub described allowances jumping from 0% to 49% in twelve minutes after a couple of prompts, accounts burning maximum tokens for three straight days untouched, and one card charged for an auto-upgrade the owner never requested.
De Swardt never received one of Anthropic's warning emails and says he found no evidence his own machine was compromised, which leaves the entry point unexplained in at least one case. Anthropic declined to comment when asked how users can identify misuse.
Outlook
The practical defence is unglamorous: remove the malware, rotate credentials, revoke every other session, and treat a browser cookie as a live key rather than a convenience. The wider issue is that subscription AI now carries real monetary value in a session token, and providers have not built the usage forensics that other metered services take for granted. Anthropic's recent moves toward tighter account controls, including the shared memory layer it built across Claude and Cowork, only raise the stakes on what a hijacked session can reach.
FAQ
Was Claude itself hacked?
No. Anthropic says the theft happened on users' own computers via general-purpose infostealer malware that harvests locally stored cookies and credentials. The company states it has no reason to believe the malware is related to Claude or was installed through it.
How do I know if my Claude session was stolen?
The clearest sign is usage that refills and then drains while you are not working. Anthropic named that pattern explicitly in its warning email. Because the account interface shows total rather than itemized usage, unexplained consumption on idle days is currently the main available signal.
Does multi-factor authentication stop this attack?
No. A stolen session cookie represents an account that has already completed login, so the attacker never encounters the password or MFA prompt. Revoking active sessions and removing the malware are the effective responses; enabling MFA alone is not.
