Hackers Hijack Anthropic's Claude AI Accounts Using Infostealer Malware
Infostealer malware is targeting Anthropic's Claude AI platform, stealing session cookies to bypass MFA and hijack user accounts, while a separate attack uses malicious Claude ads to deploy RATs.
Anthropic's popular AI platform, Claude, is currently under siege from multiple cybercriminal operations that are compromising user accounts, leading to unauthorized usage and potential data theft. Two primary attack vectors have been identified: one involving widespread infostealer malware and another leveraging malicious advertising and tampered software installers.
The first wave of attacks utilizes well-known infostealer malware families such as Vidar, Lumma, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS. These tools are designed to harvest sensitive information directly from infected machines, including saved passwords, browser cookies, and locally stored credentials. Crucially, these infostealers target session cookies, which are already authenticated tokens. By stealing these cookies, attackers can effectively bypass multi-factor authentication (MFA) and single sign-on (SSO) mechanisms, allowing them to hijack active user sessions without needing to know the actual login credentials.
Anthropic detected this pattern by observing unusual usage patterns, where paid usage limits were rapidly depleted while account owners were inactive. In response, the company has begun proactively signing out compromised accounts, removing saved payment methods to prevent further unauthorized charges, and issuing refunds for fraudulent transactions. However, Anthropic emphasizes that these account-level remediations do not remove the malware from an infected device, meaning a newly created session could be compromised again upon the next login if the underlying malware remains.
A separate, sophisticated attack campaign dubbed 'FakeAgent' has also been uncovered, which weaponized Claude's own infrastructure. Between July 21 and July 22, 2026, users searching for the "Claude desktop app" on Bing were presented with sponsored ads leading to a malicious artifact hosted on the legitimate claude.ai domain. This allowed the fake installer, disguised as ClaudeDesktop.exe, to inherit the domain's SSL certificate and search authority, lending it an air of legitimacy. The installer employed DLL sideloading techniques using a tampered libcef.dll and a repurposed JetBrains binary to deploy SectopRAT, a .NET remote access trojan.
SectopRAT is capable of harvesting browser credentials, credit card data, cookies, and files from compromised systems. Security firm Huntress reported that at least 29 organizations were affected by the FakeAgent campaign within just two days, with the malicious Claude download page accumulating approximately 7,100 downloads before Anthropic could remove it.
Adding to the complexity, a new persistence technique has emerged involving poisoned SKILL.md files, which are used as documentation and configuration files for Claude's agent skills. Attackers embed malicious instructions within these files, disguised as ordinary style guide notes. When Claude processes these tainted files, hidden commands can silently re-download the infostealer and harvest credentials. This method is particularly insidious as it can survive a full operating system reinstallation if the malicious SKILL.md file is reintroduced to the system.
Anthropic advises users to perform a full malware scan on their devices before logging back into Claude. Recommendations include resetting the password for the email account associated with Claude, ensuring MFA is enabled, updating any saved browser credentials, and exercising extreme caution with AI-generated links or terminal commands. For organizations deploying Claude at scale, security researchers suggest sandboxing AI agent environments and auditing SKILL.md files for hidden instructions to prevent further compromise.
This follow-up report details Anthropic's specific remediation steps for affected users, emphasizing the need to remove malware from compromised systems before resetting passwords and re-enabling two-factor authentication. It also clarifies that the infostealer malware is not directly related to Claude itself but rather a general threat that targets saved browser credentials and session cookies, with one user tracing their infection to pirated software.
This new report details that the infostealer malware involved, including Vidar, LummaC2, StealC, RedLine, Acreed, and Atomic Stealer, is not specific to Anthropic's platform but is rather a general-purpose tool that has recently begun targeting Claude sessions. Anthropic is actively detecting these fraudulent attempts, logging out affected users, and removing saved payment methods to prevent further abuse, as evidenced by an email sent to a user who had their credentials compromised after downloading cracked software.
This new report from Anthropic clarifies that the infostealer malware, including Vidar, Lumma, StealC, RedLine, Acreed, and Atomic Stealer, is a general-purpose threat not specifically targeting Claude. The malware typically infects user machines through unofficial downloads or malicious applications, subsequently stealing saved passwords and browser cookies. Anthropic has taken steps to mitigate the impact by signing out affected sessions, removing payment methods, and issuing refunds for unauthorized charges.
This new report indicates that the threat actor employed a variety of infostealer malware, not just a single type, to achieve their objective of stealing session information. The exact number of affected users remains unknown, adding to the uncertainty surrounding the full scope of the breach.
This new report from Malwarebytes Labs details how infostealer malware specifically targets active browser session cookies to hijack Claude accounts, bypassing traditional authentication methods. The attackers are leveraging these stolen sessions to consume user usage credits, potentially leading to unauthorized charges, and Anthropic is taking steps to mitigate this by signing out affected users and removing payment methods.
The article also highlights a separate, concerning development where a malicious GitHub repository impersonating Anthropic is distributing RevStealer malware. This infostealer targets passwords, cryptocurrency wallet data, and login credentials, further demonstrating the multifaceted threats users face when interacting with AI services and related platforms.
Recent analysis indicates that information-stealing malware is now actively targeting local data from AI coding agents, including Claude, Cursor, and Codex. Attackers are adapting existing stealers to collect access tokens, prompt histories, and project records from compromised machines, exploiting predictable local storage locations rather than flaws in the AI models themselves. This broadens the attack surface beyond just session cookie theft, potentially exposing sensitive project details and reusable authentication secrets.
This new campaign expands on the threat by distributing MacSync, a macOS password-stealing malware, through fake installers for both Claude and ChatGPT. Unlike previous attacks that may have directly targeted AI platform accounts, this method relies on social engineering via sponsored search results and Terminal commands to compromise Mac users' devices, stealing a broader range of sensitive data including browser credentials, Keychain data, and cryptocurrency wallet information.