Infostealer Malware Drains Claude Sessions and Triggers Unauthorized Charges

In recent cybersecurity developments, infostealer malware has targeted users by harvesting active Claude login sessions directly from personal computers. This unauthorized access allowed malicious actors to compromise accounts, leading directly to unexpected usage drains and unauthorized financial charges for victims who discovered their subscriptions had been exploited.

Addressing the security incident, AI company Anthropic took swift remedial action to protect its user base. The organization signed users out of their compromised accounts, deleted any saved payment cards associated with the affected profiles, and successfully processed refunds for the unauthorized charges incurred during the breach.

According to official findings released during the investigation, Anthropic identified six distinct malware families responsible for harvesting the active login sessions. The malicious software variants include Vidar, Lumma, StealC, RedLine, Acreed, and Atomic Stealer, which is also commonly referred to by its acronym AMOS.

The scale and impact of the incident became apparent as users reported anomalous account behavior across various digital platforms. Describing the specific pattern of compromise, Anthropic noted in a statement addressing the affected community, "If your usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause."

The security incident highlights ongoing vulnerabilities related to infostealer malware targeting session tokens and active login credentials stored on user devices. While Anthropic has worked to mitigate the immediate financial and account security impacts through direct interventions such as card deletions and refunds, the discovery underscores the pervasive threat posed by these specific malware families operating across personal computer systems globally.