Anthropic Warns Claude Users of Session Hijacking via Info-Stealing Malware
Anthropic has warned Claude users that local info-stealing malware has hijacked active login sessions, allowing attackers to access accounts and steal usage data. In response, the company is logging out affected users, removing saved payment methods, and refunding unauthorized charges. This incident highlights the growing threat of session hijacking, which bypasses multi-factor authentication (MFA) by stealing post-authentication tokens directly from the user's device. It underscores that even secure cloud services remain vulnerable if the client-side environment is compromised by malware. The malware involved includes Windows-based stealers like Vidar, LummaC2, StealC, RedLine, and Acreed, as well as Atomic Stealer (AMOS) on macOS, often distributed via pirated software. Anthropic clarified that this is a client-side compromise and not a breach of their own servers or infrastructure.
## BACKGROUND
Session hijacking (or cookie hijacking) occurs when an attacker steals a user's session cookie to impersonate them on a remote server without needing their password or MFA. Info-stealers are a class of malware designed to harvest sensitive data, such as credentials and cookies, from infected devices, often sold under a malware-as-a-service model.