1 SEP 2026 — Anthropic says commodity infostealer malware is being used to hijack Claude accounts and run premium usage on the victim's bill. Nothing about Claude was breached. The malware is on the user's own machine, and the stolen session walks straight past multifactor authentication.

What is happening

Six infostealer families are named: Vidar, LummaC2, StealC, RedLine, Acreed and Atomic Stealer. These are ordinary commodity malware, sold and rented, that harvest whatever they find on an infected computer — saved passwords, browser cookies, session tokens and the material needed to get past multifactor prompts.

The new behaviour is at the sorting stage. An operator now picks the Claude sessions out of the general haul and uses them, running paid inference against somebody else's subscription. Anthropic's response in at least one case was to log the user out and delete their stored payment method, having detected evidence of attempted fraud.

Six familiesVidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer
Session cookiesWhat is stolen, and what defeats MFA
Not ClaudeThe malware arrives by other means entirely
Payment methodDeleted by Anthropic as a fraud response

Multifactor authentication does not stop this

The instinctive response to an account compromise is to recommend MFA. It does not help here.

MFA protects the act of logging in. Once you have logged in, the service issues a session token, usually stored as a browser cookie, and that token is what proves you are you for the rest of the session. It exists precisely so you are not challenged on every request.

The infostealer takes the session token, not the password. Replaying it in another browser logs the attacker straight in. No second factor is requested because, from the service's point of view, authentication has already happened. Rotating the password does not invalidate it either, unless the service explicitly revokes sessions on password change.

Shorter session lifetimes, binding tokens to a device or IP, and revoking all sessions after a suspicious event are all effective. These are provider-side controls. A user's only real defence is not getting infected.

The novelty is the monetisation, not the theft

Infostealers have been collecting browser sessions for a decade. What changed is that a Claude session is now worth sorting out of the pile and using.

The closest precedent is cryptojacking, where attackers stole processing power to mine currency. This has the same economic shape but a better product. Inference capacity has a market price, is billed to a third party, and converts to cash more reliably than cryptomining ever did. A stolen subscription can be resold as cheap access, or used directly to run work the buyer would otherwise pay for.

The theft has a durable economic logic, which is what makes a technique persist. Stolen credit card numbers get cancelled. Stolen AI subscriptions keep working until somebody notices the usage.

The victim finds out through the bill

The harder problem is detection, because the usual signals are absent.

A hijacked session produces no failed logins, no password reset emails and no new-device alerts, since the device fingerprint may be spoofed and the authentication event never repeats. The account behaves normally for its legitimate owner. What changes is consumption, and on a flat-rate subscription that may not be visible at all until a rate limit is hit unexpectedly.

Anthropic's response — deleting the stored payment method — is the sharpest detail, and it runs in two directions. It stops the fraud reaching the victim's card. It also means an account can be disabled by a fraud response to an event the owner never saw, who then learns of the infection only when their tooling stops working.

Where this sits in a pattern

Three recent stories on this site describe the same shift, and it is worth naming.

The McKesson intrusion ran through vishing to single sign-on credentials and contained no exploit. Five browser extensions were bought from their authors and poisoned by an automatic update, so store review never applied. And here, malware on an endpoint monetises a legitimate session token.

None of the three involves a vulnerability in the service being abused. The attacks target the credential, the update channel or the session — the plumbing around authentication, not authentication itself. A security programme built on patching and vulnerability management addresses none of them.

What to do about it

For an individual, the advice is unglamorous. Infostealers arrive through cracked software, malicious downloads and fake update prompts. The exposure is what you install, not how you configure your account. Sign out of sessions you are not using, review active sessions where a provider exposes them, and treat any unexplained rate limit as a possible signal rather than a glitch.

For an organisation the calculation is different, because employees are increasingly running paid AI subscriptions on machines the company does not manage. A stolen session from a personal device is an unmonitored route into whatever that account can reach, and the conversation those firms have been having about shadow AI has been about data leaving. This is the same account and the opposite direction.