Infostealers are draining Claude accounts through stolen sessions, and the session token is the credential that matters

Anthropic has emailed some Claude users an uncomfortable notice: a bad actor is using common infostealer malware to lift their Claude login sessions straight off their computers, then spending their paid usage. The company put it plainly, telling affected users it had “become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage.” This is not a flaw in Claude. It is a reminder that an authenticated session is a bearer credential, and on a developer’s machine that credential sits in a browser profile right next to everything else an infostealer already knows how to grab.

How the session becomes the key

Infostealers are commodity malware. Once one runs on a machine, it quietly copies saved passwords, browser login cookies, and credentials for other local applications, then ships the bundle off to be sold or reused. A live Claude session cookie is just one more high-value item in that log. Because the cookie represents an already authenticated state, replaying it bypasses the password and any multi-factor prompt, so the attacker never touches the login page the account owner worked to lock down. Anthropic named the families it saw: Vidar, Lumma, StealC, RedLine, and Acreed on Windows, with Atomic Stealer (AMOS) on a small number of macOS devices. The lesson underneath the list is the uncomfortable one: MFA protects the login, not the session that outlives it.

The bill arrives before the alert

The theft shows up as spend. Attackers burn through an account’s included allowance, and where auto-reload or Usage credits are enabled, they can trigger further purchases on the victim’s card. One affected user, AI consultant Grant De Swardt, watched his usage climb from zero to fully consumed in about half an hour before he understood what was happening, and told TechCrunch the attackers had minted unauthorized Claude Code OAuth tokens from his stolen session. The practical detection signal for everyone else is the same shape: rapid usage depletion while the authorized user is idle, an auto-reload that fires at an odd time, a surprise credit purchase. De Swardt’s deeper complaint is worth noting, since Anthropic could not give him an itemized breakdown of what had been spent. For a paid developer tool, usage spend is now a security signal, not just a billing line, and the absence of granular logs makes that signal harder to read.

Why developers are the soft target

Claude Code sharpens the exposure. It runs on the same machine a developer uses for everything, and it authenticates with an OAuth token stored locally. TechCrunch’s report that stolen sessions were used to create unauthorized Claude Code OAuth tokens matters more than a drained browser session, because a minted token is durable programmatic access rather than a cookie that a sign-out can kill. Developer machines are also credential-dense: cloud keys, git tokens, SSH keys, and now an agent token all live in the same few directories. A single stealer infection exposes many services at once, and Claude is simply one of them. For a working dev, the practical shift is that the Claude Code token should be treated like any other API secret, and a compromised laptop means rotating far more than one password.

What Anthropic did, and what to do

Anthropic’s response was containment rather than disclosure. It signed out the affected sessions, removed the saved payment method from those accounts, and refunded charges it identified as unauthorized, while warning users to only re-add a card after confirming all malware has been cleared from the machine. That ordering is the right model to copy. Scan and clean the machine first, change the email account password and enable 2FA on it, rotate sensitive saved credentials, and only then sign back into Claude and restore a payment method. It is also a reasonable moment to ask whether auto-reload should be on by default, since it converts a usage cap into an open spending line.

The scope here is genuinely unclear. Anthropic has not published numbers or a public advisory, and the notice reached affected users by email rather than a status page, so the corroboration comes from security press reproducing the same statement. What is clear is the direction. The model did not get compromised; the machine in front of it did. As more of the toolchain authenticates with long-lived tokens sitting in local files, the session becomes the thing worth stealing, and protecting it becomes part of the developer’s job, not only the vendor’s.

Sources cited

1. Anthropic's notice to affected users, with confirmation of unauthorized access (TechCrunch) techcrunch.com
2. Anthropic Warns Claude Users of Infostealer Malware Infections (SecurityWeek) www.securityweek.com
3. Infostealers are hijacking Claude accounts at users' expense (Malwarebytes) www.malwarebytes.com