Anthropic Warns of Malware Stealing Claude User Sessions, Takes Action

Anthropic recently notified some Claude users that their computers were infected with information-stealing malware, resulting in the theft of active Claude login sessions. Attackers used these stolen sessions to access user accounts and obtain usage data. The company has forcibly logged out affected users from Claude, removed their saved payment methods, and refunded any unauthorized charges. Anthropic stated that its investigation is ongoing and that initial findings suggest users’ devices may have been infected with common information-stealing malware. Such malware typically enters systems through downloaded files or malicious applications and steals locally stored browser passwords, login cookies, and other application credentials. Anthropic emphasized there is no evidence indicating that the malware is related to Claude, was installed via Claude, or is connected to users’ use of Claude. Identified malware includes Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and AtomicStealer (AMOS) on macOS. Anthropic advises affected users to change their credentials, revoke other active sessions, and remove the malware from their devices.