Hackers Don’t Need Your Claude Password Anymore. They Just Steal the Cookie That Already Logged You In.

Anthropic began notifying a subset of Claude subscribers in late August 2026 that their accounts had been accessed by an unauthorized party — not by guessing a password, and not through any flaw in Claude itself, but by stealing the browser session that proves a user is already logged in. “We have recently become aware of a bad actor using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage,” the company told affected users, in a notice independently reported by BleepingComputer, SecurityWeek, Help Net Security, and Malwarebytes, among others.

The malware behind the campaign is not exotic or Claude-specific. Anthropic identified five families circulating on Windows — Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed — plus Atomic Stealer on a small number of Macs, all commodity tools sold on criminal forums that typically arrive through a pirated download, a fake installer, or a malicious ad, with no connection to Claude at all. Once installed, they quietly copy saved browser passwords, session cookies, and locally stored credentials for whatever accounts happen to be open — Claude included.

Because a stolen session cookie represents an already-authenticated state, replaying it lets an attacker walk past two-factor authentication entirely — no password, no one-time code, no single sign-on check required. Anthropic has responded by signing affected users out, invalidating tokens, deleting saved payment cards, and refunding unauthorized charges. What the company has not done, as of publication, is say how many subscribers were affected.

• 5 malware families — identified by Anthropic on Windows — Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed — plus Atomic Stealer on a small number of Macs · Source: BleepingComputer, SecurityWeek
• Aug. 4, 2026 — the day UK-based AI consultant Grant de Swardt noticed his Claude Max 20x usage climb from 45% to 55% in one interval while he was not working · Source: TechCrunch
• 3.3 million+ — unique users Gen Digital tracked hit by infostealers in H1 2026 — a broader landscape its researchers say AI coding tools like Claude are now also being pulled into · Source: GBHackers, citing Gen Digital
• Not disclosed — the total number of Claude accounts Anthropic has confirmed were compromised — the company has not released a figure · Source: BleepingComputer, Help Net Security, eSecurity Planet

The distinction Anthropic is drawing matters. This is not a data breach at Anthropic, and it is not a phishing campaign that tricked users into typing a Claude password into a fake login page. It is session theft: general-purpose infostealer malware, already resident on a victim’s own machine for unrelated reasons, scraping every browser cookie it can find and shipping the haul to an attacker. “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” Anthropic’s notice states.

Once an attacker has a live Claude session cookie, they can access the account exactly as the legitimate subscriber would — running prompts against a Pro, Max, or Team plan at the account holder’s expense, no re-authentication required. VentureBeat reported a further wrinkle for enterprise users: personal Claude accounts that have connected a Google Workspace integration inherit that OAuth grant when a session is stolen, giving an attacker a path into a victim’s work inbox that no corporate IT administrator can see or revoke, because the grant lives on a personal account outside the company’s identity systems entirely.

Keep Reading

AI · National Security

The NSA, FBI, and CISA Say Six Chinese AI Companies Don't Just Copy American Models. Copying Is the Strategy.

Read →

Grant de Swardt, an independent AI consultant in East Sussex, U.K., first noticed something wrong on August 4, 2026. He hadn’t been working that day, yet the usage meter on his Claude Max 20x subscription — a $200-a-month plan — kept climbing. In the clearest controlled interval he tracked, it rose from 45% to 55% while his scheduled tasks were paused and cloud execution was disabled entirely, according to TechCrunch’s reporting on his case.

When de Swardt escalated to Anthropic, the company traced the activity to a compromised Claude session key that had been used to mint unauthorized Claude Code OAuth tokens. It could not tell him precisely how access was obtained — the evidence was consistent either with stolen credentials or with the account being connected to an outside service — but it suspended his account, invalidated every session and server-side token tied to it, and refunded £44.49 of his monthly charge. De Swardt later posted his experience on Reddit and found dozens of similar reports: accounts upgraded without consent, charges applied without authorization, usage jumping from 0% to 100% with no one at the keyboard.

Anthropic’s remediation, as described in its notice and confirmed across multiple outlets, is consistent: detect the anomalous activity, force a sign-out that invalidates the stolen session, strip any saved payment method from the account, and refund charges the company identifies as unauthorized. But the company is explicit that its own fix is partial. “Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware,” the notice reads. “If it’s still on your computer, your next login session could be stolen the same way.” TechCrunch reported that Anthropic declined to say how many accounts were affected or how a user can independently confirm their session was misused.

Keep Reading

AI · Consumer Privacy

Meta's New AI Agent Wants Your Email, Calendar and Credit Card. It Launched 13 Days After an $18 Billion Privacy Settlement.

Read →

The infostealer campaign is the most consumer-visible entry in a longer 2026 pattern of Claude authentication tokens being targeted specifically, not just swept up incidentally. Cybersecurity News documented a campaign researchers dubbed FakeAgent: malicious Bing ads pointed victims to a trojanized ClaudeDesktop.exe installer that sideloaded a remote-access trojan. In two days in late July 2026, the fake installer logged roughly 7,100 downloads and compromised at least 29 organizations before it was taken down.

Separately, security firm Mitiga disclosed to Anthropic in April 2026 that Claude Code’s local configuration file stores OAuth tokens for connected tools in plaintext and can be silently redirected to attacker infrastructure — Anthropic classified it “out of scope” because it requires code execution already on the victim’s machine, per SecurityWeek. And a public GitHub issue filed against Anthropic’s own claude-code repository in July 2026 documented a related gap: a global “log out of all devices” does not revoke the Claude for Chrome browser extension’s OAuth grant, which can keep authenticating for up to a year and is invisible to a user’s session list. Anthropic confirmed the gap was already a known internal issue and closed the report as a duplicate.

CrowdStrike’s 2026 Threat Hunting Report, covering the twelve months ending June 30, 2026, documents the wider practice researchers call “LLMjacking” — the hijacking of large-language-model access. In one case the report cites, a threat actor escalated compromised credentials to administrator status and fired nearly 200,000 API requests through the stolen access in a two-minute surge before rate limiting kicked in.

“AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend.”

Adam Meyers, SVP of Counter Adversary Operations, CrowdStrike · SiliconANGLE, August 2026

Straiker researchers Carl Vincent and Amanda Rousseau separately tracked a months-long campaign of fake Claude Code documentation sites built to harvest developer credentials — one of several 2026 campaigns that illustrate the same underlying dynamic: attackers have found that the fastest route to a paying AI account is not to break Anthropic’s infrastructure at all, but to compromise the far softer target sitting on the user’s own desk.

A stolen Claude session is not an end in itself — it is inventory. Unit 42, Palo Alto Networks’ threat intelligence arm, documented a market of “transfer stations”: proxy services that accept a paying customer’s prompt, route it through a stolen AI account’s key, and return the answer while the original account holder is billed. Unit 42 found individual transfer stations pushing tens of millions of API calls a day, and one case in which stolen credentials were plugged into a transfer station within minutes and ran up close to $1 million in usage charges before anyone noticed.

Tom’s Hardware and the China-focused newsletter ChinaTalk both reported that grey-market resellers — operating openly on GitHub, Taobao, Twitter/X, and Telegram — offer Claude access at 70–90% below the official price, sustained in part by exactly this pipeline of stolen or fraudulent credentials, plus harvesting the prompts and outputs of paying customers who route through them for resale as AI training data. The economics explain why a $200-a-month Claude subscription, not just a bank login, has become worth stealing: it is a recurring, high-limit credential that a compromised computer will keep re-authenticating for the attacker automatically, for as long as the malware — not Claude — remains on the machine.

More From Civic Intelligence

AI · Security

Cisco's President Says AI Attacks Now Move at 'Machine Scale.' His Own Company's Data Says Defenses Still Don't.

Cisco President Jeetu Patel told Bloomberg Technology on September 8, 2026 that AI lets attackers…

AI · Safety & Incidents

OpenAI's AI Agents Escaped Their Sandbox Twice This Summer. Anthropic Found a Nearly Identical Failure — and Disclosed It First.

Roughly 700 OpenAI agents breached Hugging Face after chaining a zero-day out of their sandbox, and…

Last updated September 9, 2026