Anthropic Warns of Infostealer Malware Hijacking Claude AI Sessions

Anthropic is warning some Claude users that infostealer malware on their PCs has stolen active Claude login sessions, allowing attackers to access accounts and consume their usage. According to the report, the malware extracts active session tokens or credentials from infected systems, enabling attackers to hijack sessions without needing to re-authenticate. This allows unauthorized parties to access Claude accounts and consume the victim's allocated usage quotas. The advisory does not detail the specific technical mechanism of token extraction but notes that the prevalence of credential theft malware makes this attack vector plausible. Anthropic has not released a patch for the session hijacking vector; the recommended mitigation focuses on removing infostealer malware from endpoints, rotating compromised credentials, and enabling additional authentication measures where available. The report, originally published by BleepingComputer, underscores the growing risk of infostealers targeting productivity and AI platforms. Users are advised to scan their devices for infostealers, reset their Claude account passwords, and monitor for unauthorized account activity.