Infostealer malware is hijacking active Claude login sessions and draining paid usage quotas without needing a password. Here is what service businesses using AI tools must do right now.
Ido Cohen · Published 2026-08-31 · AI for Service Business
Anthropic began locking Claude users out of their accounts on August 30, 2026, after discovering that a wave of infostealer malware had stolen active login sessions from user computers and handed them to attackers who burned through paid usage quotas — without ever needing a password. If your business uses Claude for writing, client communication, or any AI-assisted workflow, this is not a distant enterprise problem. It is happening on Windows PCs just like the ones sitting in your front office right now.
This was not a hack of Anthropic's servers. The attackers never touched Claude's infrastructure.
According to BleepingComputer's reporting on Anthropic's own email to affected users, the company warned: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage." Anthropic was clear that "this malware is not related to Claude, installed through Claude, or related to anything you did with Claude." The infected machines had been compromised first — Claude was simply one of many things the malware swept up on its way out the door.
Here is how the attack chain works, step by step:
1. Malware lands on your PC — typically through a pirated download, a malicious ad, or a fake app
2. The infostealer runs silently — copying saved browser passwords, autofill data, and session cookies
3. Session cookies are exfiltrated — sent to the attacker's server along with credentials for dozens of other services
4. The attacker replays your Claude session cookie — from their own machine, using it as if they were already logged in
5. Your usage quota drains — while you sleep, or while you are with a client, your Claude credits disappear
Cybersecurity News reported that attackers were detected because usage limits were "refilled and then drained while account owners were inactive" — an eerie pattern that Anthropic's systems eventually flagged. If you have ever noticed your Claude usage looking off and assumed it was a billing glitch, it may not have been.
Session theft is more dangerous than password theft because it bypasses every login security layer you have.
When you log into Claude, your browser receives a session cookie — a digital ticket that says "this device is already verified." Security Affairs explained it plainly: an infostealer "copies that cookie and an attacker who 'replays' it is treated as an already-logged-in user." Because the cookie represents a completed login, there is no password prompt and no two-factor authentication (2FA) challenge. From Claude's perspective, the request looks identical to you opening a new tab.
This is why the standard advice — "use a strong password and turn on 2FA" — is not sufficient protection against this specific attack vector. By the time the session cookie is stolen, both of those controls have already been bypassed. Help Net Security described it directly: "Session theft is the new credential theft, as it allows attackers to sidestep two-factor authentication."
The six malware families Anthropic named in its advisory are not exotic or new:
According to Anthropic's advisory cited by Help Net Security, all of these are "general-purpose malware that typically arrives with an unofficial download or a malicious app, and it quietly copies saved passwords, login cookies in browsers, and credentials for other apps running locally."
There is a darker layer to this story that most coverage has glossed over.
Security firm Huntress tracked a separate but related campaign, dubbed "FakeAgent," in which cybersecurity news outlets reported that between July 21 and July 22, 2026, attackers purchased sponsored search ads on Bing pointing to a fake "Claude desktop app" download page. The fake installer launched a chain that ultimately deployed SectopRAT, a remote-access trojan capable of harvesting browser credentials, payment card data, cookies, and files. Huntress reported compromises at at least 29 organizations over those two days, estimating the malicious file received roughly 7,100 downloads before Anthropic removed it.
That number — 29 organizations in two days from a single fake download — should make any small service business sit up. Attackers are not just passively waiting for users to download something suspicious. They are buying Google and Bing ads to intercept people actively searching for legitimate AI tools.
An even newer persistence trick has emerged: poisoned SKILL.md files, which are documentation-style configuration files used by Claude's agent skills. Cybersecurity News reported that attackers disguise malicious instructions as ordinary notes; when Claude loads the file, hidden commands silently re-download the infostealer — meaning the malware can survive even a full OS reinstall if the tainted file is reintroduced.
Dentists, contractors, real estate agents, and plumbers are not typical cybersecurity targets — but that is exactly why they are soft targets.
Consider what a typical service business computer looks like. One Windows PC or laptop handles everything: QuickBooks, email, the practice management software, Google Business Profile, and — increasingly — Claude or ChatGPT for drafting estimates, client emails, service descriptions, and marketing copy. That same machine is used by multiple staff members, rarely has endpoint security software beyond Windows Defender, and is routinely used to download PDFs, invoices, and apps from vendor emails.
That environment is exactly where infostealers thrive. The malware does not care whether you are a cybersecurity firm or an HVAC company. It sweeps whatever is on the machine. And for a service business, "whatever is on the machine" often includes:
The good news, according to multiple reports: Anthropic detected the pattern quickly, forced sign-outs of compromised sessions, removed saved payment methods from affected accounts, and issued refunds for unauthorized charges it identified. The platform responded well. But Anthropic was also clear, as reported by Help Net Security: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware." If the infected machine is not cleaned, the next session will be stolen too.
This is a five-step checklist. Do all five before the end of this week.
Step 1: Run a full malware scan — not just Windows Defender
Download and run Malwarebytes Free (or a comparable scanner like HitmanPro) on every computer your business uses to access Claude, ChatGPT, Google Ads, or your banking. Windows Defender misses most infostealer families routinely. Anthropic's guidance, as reported by Help Net Security, is to scan for and remove malware before taking any other step, because signing out and resetting passwords on an infected machine accomplishes nothing.
Step 2: Log out of all active Claude sessions manually
Go to Claude.ai → your account settings → active sessions → sign out all. Do this for ChatGPT, Google, and any other AI or marketing platform you use. Revoking existing sessions invalidates any cookies already stolen.
Step 3: Change passwords on every browser-saved credential
Infostealers do not just take session cookies — they harvest every saved password in Chrome, Edge, Firefox, and Safari. Change passwords for your AI tools, Google Ads, Meta Business Manager, email, and banking. Use a password manager going forward rather than browser-saved passwords.
Step 4: Enable two-factor authentication everywhere — and switch to an authenticator app
2FA does not stop session cookie theft, but it stops the more common password-spray attacks that also run in parallel. More importantly, switch from SMS-based 2FA to an app like Google Authenticator or Authy. SMS codes can be intercepted; app-generated codes cannot.
Step 5: Brief your staff and establish a download policy
The most common entry point for infostealers is an unofficial download — a cracked app, a "free" PDF editor, a pirated plug-in. Your receptionist does not know that "ClaudeDesktop.exe" from a third-party site is fake. Write a one-paragraph policy: no software downloads from any source that is not an official app store or the vendor's own verified website. Pin it next to the monitor.
Bonus: Check your browser download history
Open Chrome's download history (Ctrl+J) and look for anything downloaded in the last 90 days that you do not recognize. Delete and quarantine anything suspicious.
---
How do I know if my Claude account was compromised?
The clearest signal is usage limits that appear to refill and then drain rapidly while you are not actively using the platform. Anthropic also sent direct emails to affected users when it detected the suspicious pattern. Check your Claude usage dashboard — if you see activity at times you were not working, treat that as a red flag and follow the five steps above immediately.
Does this mean Claude itself is insecure?
No. Anthropic confirmed that the platform itself was not breached and that the malware had nothing to do with Claude specifically. The attack exploits a weakness in how all web applications handle login sessions, combined with malware on user devices. Any platform you stay logged into — Google, Microsoft, your CRM — is vulnerable to session cookie theft from an infected computer.
I use ChatGPT, not Claude. Am I still at risk?
Yes. Session hijacking is not a Claude-specific problem. Every AI platform, every Google Ads account, every banking portal that keeps you logged in via browser cookies is theoretically exposed to the same attack if your computer is infected with infostealer malware. The same cleanup steps apply regardless of which AI tools you use.
My business doesn't use Claude — does this story matter to me?
It should still prompt action. The malware families involved — Vidar, LummaC2, RedLine, and others — are general-purpose stealers. They target everything on the machine: email accounts, Google Business Profile, financial platforms, and social media. Your AI tool is one item on their checklist, not the only one.
What is Anthropic doing to prevent this from happening again?
Multiple reports note that users are beginning to adopt Chrome's Device Bound Session Credentials (DBSC) — a newer browser security feature that cryptographically ties session tokens to the specific device, making stolen cookies useless on a different machine. Anthropic has not publicly announced platform-level changes, but DBSC adoption at the browser layer is the structural fix that makes session replay attacks significantly harder. Check whether your browser version supports it and enable it if available.
---
Sources: