Hackers Hijack Anthropic's Claude AI Accounts Using Infostealer Malware
Infostealer malware is targeting Anthropic's Claude AI platform, stealing session cookies to bypass MFA and hijack user accounts, while a separate attack uses malicious Claude ads to deploy RATs.
Anthropic's popular AI platform, Claude, is currently under siege from multiple cybercriminal operations that are compromising user accounts, leading to unauthorized usage and potential data theft. Two primary attack vectors have been identified: one involving widespread infostealer malware and another leveraging malicious advertising and tampered software installers.
The first wave of attacks utilizes well-known infostealer malware families such as Vidar, Lumma, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS. These tools are designed to harvest sensitive information directly from infected machines, including saved passwords, browser cookies, and locally stored credentials. Crucially, these infostealers target session cookies, which are already authenticated tokens. By stealing these cookies, attackers can effectively bypass multi-factor authentication (MFA) and single sign-on (SSO) mechanisms, allowing them to hijack active user sessions without needing to know the actual login credentials.
Anthropic detected this pattern by observing unusual usage patterns, where paid usage limits were rapidly depleted while account owners were inactive. In response, the company has begun proactively signing out compromised accounts, removing saved payment methods to prevent further unauthorized charges, and issuing refunds for fraudulent transactions. However, Anthropic emphasizes that these account-level remediations do not remove the malware from an infected device, meaning a newly created session could be compromised again upon the next login if the underlying malware remains.
A separate, sophisticated attack campaign dubbed 'FakeAgent' has also been uncovered, which weaponized Claude's own infrastructure. Between July 21 and July 22, 2026, users searching for the "Claude desktop app" on Bing were presented with sponsored ads leading to a malicious artifact hosted on the legitimate claude.ai domain. This allowed the fake installer, disguised as ClaudeDesktop.exe, to inherit the domain's SSL certificate and search authority, lending it an air of legitimacy. The installer employed DLL sideloading techniques using a tampered libcef.dll and a repurposed JetBrains binary to deploy SectopRAT, a .NET remote access trojan.
SectopRAT is capable of harvesting browser credentials, credit card data, cookies, and files from compromised systems. Security firm Huntress reported that at least 29 organizations were affected by the FakeAgent campaign within just two days, with the malicious Claude download page accumulating approximately 7,100 downloads before Anthropic could remove it.
Adding to the complexity, a new persistence technique has emerged involving poisoned SKILL.md files, which are used as documentation and configuration files for Claude's agent skills. Attackers embed malicious instructions within these files, disguised as ordinary style guide notes. When Claude processes these tainted files, hidden commands can silently re-download the infostealer and harvest credentials. This method is particularly insidious as it can survive a full operating system reinstallation if the malicious SKILL.md file is reintroduced to the system.
Anthropic advises users to perform a full malware scan on their devices before logging back into Claude. Recommendations include resetting the password for the email account associated with Claude, ensuring MFA is enabled, updating any saved browser credentials, and exercising extreme caution with AI-generated links or terminal commands. For organizations deploying Claude at scale, security researchers suggest sandboxing AI agent environments and auditing SKILL.md files for hidden instructions to prevent further compromise.