Malware Steals Claude Sessions and Drains Quotas

Anthropic has alerted some clients about a session theft involving Claude due to malware. Victims report quotas being consumed without their knowledge and, in at least one case, the bypassing of 2FA protections through stolen Chrome credentials. This is not a hack of the service but rather local infections. Simply logging out is not enough: the malware must be removed.

Hijacked sessions and accounts beyond Claude

One account states that the hacker was able to access all credentials stored in Google Chrome, including cookies and session identifiers, which allowed them to bypass two-factor authentication protections. The malware does not only target Claude and can expose other accounts as well. Regarding Claude, the fraudulent use of stolen sessions can lead to the depletion of the account's usage quotas. This virus, currently in circulation, is capable of accessing these accounts and exploiting them.

What Anthropic advises to limit the damage

Anthropic indicates that logging out of Claude interrupts the stolen sessions but does not remove the malware. As long as the malware remains on the computer, a new session can be compromised. Anthropic emphasizes the necessity of removing the virus to resolve the issue. Affected individuals should log back into Claude and re-register their payment method. A sign of infection may be the observation of usage limits that fill up and then empty without any service use. It is recommended to use antivirus software to eliminate the information-stealing malware.

No breach at Claude, but an info thief and common vectors

The Claude service is not directly hacked; the attack vector is information theft from infected machines. Once the machine is compromised, the attacker can retrieve data, including Claude sessions. Anthropic mentions the use of common information-stealing software to steal these sessions. One user explained they were infected after downloading a pirated game and stated they no longer want to repeat that mistake. Claude is popular among businesses and professionals. BleepingComputer reports that Anthropic confirmed the threat in an email sent to certain clients, a message that was shared on Reddit. The session theft is linked to malware distributed through channels like illegal downloads.