By admin 
A sophisticated cyberattack campaign has seen infostealer malware successfully hijack user accounts on Anthropic’s Claude AI platform by replaying stolen session cookies, effectively bypassing critical security measures like two-factor authentication (2FA) and single sign-on (SSO). This alarming tactic allows attackers to gain access to Claude accounts without ever needing to interact with the login page or its protective layers, exploiting vulnerabilities in how authenticated sessions are managed. The compromised accounts were primarily card-billed, self-serve subscriptions, a segment of users not typically governed by corporate identity providers or centralized admin consoles. This means that when an account is compromised, there is no overarching administrative oversight to detect or immediately revoke access.
The campaign, disclosed by Anthropic through notification emails to affected users, highlights a significant shift in attack vectors, where the focus has moved from stealing credentials to stealing the very proof of an established, authenticated session. Six distinct stealer malware families – Vidar, LummaC2, StealC, RedLine, and Acreed operating on Windows, along with Atomic Stealer targeting a smaller number of Macs – were identified as the culprits. These general-purpose malware programs are designed to exfiltrate a wide range of sensitive data from infected computers, including browser login cookies and saved passwords. As Anthropic’s notification explained, a user’s Claude session was likely just one piece of data collected by these pervasive infostealers.
The attack chain operates with a disquieting simplicity. Once a user’s computer is infected with one of these infostealer malware types, the malware can access and copy the active session cookie for Claude. This cookie acts as a digital passport, proving to the Claude servers that the user has already successfully authenticated. By replaying this stolen cookie, attackers can bypass the login process entirely, including any 2FA prompts, and gain immediate access to the user’s account. The effectiveness of this method lies in the fundamental nature of session cookies: they are designed to keep users logged in for convenience, but when stolen, they become a direct pathway to unauthorized access.
Anthropic detected the compromise through anomalies in usage patterns. The company observed that account limits were being refilled and then rapidly drained, often while the legitimate account owner was inactive or away from Claude. This discrepancy in usage alerted Anthropic to the malicious activity. In response, the company has been notifying affected users, proactively signing out the compromised accounts, removing saved payment methods to prevent further unauthorized charges, and initiating refunds for any identified fraudulent usage.
While the direct financial cost of the stolen usage might be considered a relatively minor loss for many users, the true peril lies in the potential exposure of sensitive data and access to connected services. Crucially, the accounts targeted in this campaign were self-serve, personal subscriptions. These accounts are outside the purview of enterprise security controls, meaning that if an employee uses a personal Claude account on a work device and connects it to corporate resources, the data within those connected services could be vulnerable.
The attack mechanism of session-cookie replay bypasses SSO just as effectively as it bypasses 2FA. While SSO solutions provide crucial capabilities for revocation and visibility into user activity, they are not inherently preventative against this specific type of attack. The stolen cookie represents an already authenticated session, rendering SSO’s preventative measures moot until the session is manually terminated or expires.
Anthropic’s notification, as reported by BleepingComputer on August 30, confirmed that a "bad actor" was leveraging common infostealer malware to steal Claude login sessions from user computers. The disclosure to affected users, who subsequently shared it on platforms like Reddit, provided a crucial insight into the nature of the threat. The named stealer families – Vidar, LummaC2, StealC, RedLine, and Acreed for Windows, and Atomic Stealer for macOS – are known for their ability to harvest cookies, passwords, and other sensitive information stored within web browsers.
A significant concern highlighted by this incident is the prevalence of personal AI accounts being used within enterprise environments. Data from Akamai’s enterprise AI risk report indicated that a substantial 47% of enterprise AI conversations were being conducted through personal identities, with Claude being particularly prevalent at 61%. This trend creates a dangerous blind spot for security teams, as employees often link these personal accounts to sensitive corporate data and applications.
One affected user, according to BleepingComputer, traced their infection to a pirated game, illustrating a common vector for malware distribution. However, the problem extends beyond casual piracy. In July, attackers went as far as to host a spoofed Claude download page on the claude.ai domain itself, utilizing a public Artifact. Sponsored Bing advertisements then directed unsuspecting employees searching for the "Claude Desktop app" straight to this malicious site. Huntress documented this campaign, dubbed FakeAgent, which employed the SectopRAT malware and resulted in the compromise of employees at 29 organizations within a mere two days. The artifact reportedly garnered approximately 7,100 downloads before Anthropic could intervene and remove it. Earlier in the year, a separate campaign, as detailed by Malwarebytes, pushed a fake Claude installer through another spoofed download site, emphasizing that the vector is not solely piracy but often arises from employees seeking official applications on their work machines.
The primary concern for security leaders is not just the immediate cost of drained usage, but the far more significant risk of data exfiltration and unauthorized access to connected services. A replayed session inherits all the permissions and access rights of the legitimate user. For Claude accounts, this can include conversation history, uploaded project files, and critically, any authorized connectors. Anthropic’s support documentation details how connectors allow Claude to interact with external services, retrieve data, and perform actions. Crucially, Claude inherits the user’s permissions from these connected services. While read and search operations may not require explicit approval, write actions—such as sending emails, forwarding messages, or modifying files—are typically approval-gated by default. However, the path for exfiltration remains open once a session is hijacked.
The availability of Google Workspace connectors for individual Claude accounts is particularly concerning. A personal Pro subscription, for instance, could hold live authorization to access a user’s Gmail inbox or a specific Google Drive folder. If this inbox is a work inbox, an attacker holding a replayed cookie gains read access to potentially sensitive corporate communications. This access bypasses the scrutiny of corporate identity providers, as the initial authorization was granted by the employee on their personal account, often without real-time oversight from IT or security teams. While Workspace or Entra administrators might have the ability to revoke underlying grants, they are often unaware of these personal account connections.
The broader market for compromised AI credentials has been growing rapidly since the explosion of ChatGPT in late 2022. Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, noted in an August 6 Axios interview that criminals have been actively buying and reselling stolen credentials for major AI platforms like ChatGPT, Claude, and Gemini. CrowdStrike’s 2026 Threat Hunting Report documented a specific "LLMjacking" campaign that generated nearly 200,000 API requests through a compromised cloud account’s AI model access in just two minutes. Meyers further elaborated on "LLMjacking" as the act of stealing credentials, with "cost harvesting" being the subsequent activity where buyers manipulate AI resources to conduct operations and generate massive bills as a byproduct, akin to "LLM coin mining."
The inherent risks of this approach were recognized by security architects. Tom Kleinpeter, co-founder and chief architect at Common Room, detailed his company’s deliberate decision to delay the integration of their AI agent with local machine components. He explained, "We rejected local MCP servers early, full stop. That path meant storing a long-lived API key or token on someone’s machine. Steal that credential, and you can impersonate the user, pull their data, or do anything else the token allows, indefinitely, until someone notices and manually revokes it. We weren’t willing to ship that." Common Room eventually implemented its agent integration in October 2025, leveraging Okta’s Auth0 for authentication, implementing separate read and write scopes, and disabling write access by default.
Even within development cycles, the potential for accidental exposure was evident. Kleinpeter recounted an instance where an AI coding agent proposed caching access tokens in plain text within Redis to streamline authentication. While technically functional, this would have exposed live credentials in shared infrastructure had a human reviewer not caught it before deployment. He identified "long-lived, broadly scoped API keys" as a significant liability in today’s environment, contrasting them with an era when a single human operated a single trusted system. Today’s multi-client, often unmonitored agent operations present a vastly different risk landscape.
Coincidentally, in the same week that Claude users were experiencing cookie theft, Okta announced the general availability of Agent SSO on August 24. This new offering registers AI agents as first-class identities within Universal Directory, issuing short-lived, identity-governed tokens instead of relying on stored credentials. Okta explicitly highlighted Claude as an example of an agent that security teams can now manage natively through this system. However, just six days later, Anthropic was forced to sign out users due to the widespread success of infostealer malware copying session cookies, underscoring the stark contrast between the evolving enterprise security solutions and the vulnerabilities exploited in personal, unmanaged accounts.
VentureBeat’s July Pulse Research on agent security revealed that 63% of 116 surveyed enterprises reported credential sharing among their AI agents, with only 3% utilizing Okta for AI Agents at that time. Kayne McGladrey, author of the forthcoming "Cyber Risk is a Myth" and a senior IEEE member, explained that the adoption of advanced security solutions like Okta’s Agent SSO is often contingent on a company having its foundational security controls in place. He noted that for organizations lacking basic defenses such as attack surface management, blast radius containment, or multi-factor authentication, advanced capabilities would not be a sensible investment.
Anthropic has stated that they have no evidence to suggest the malware is related to Claude itself, was installed through Claude, or is tied to any specific actions taken within Claude. They have also cautioned users that while signing out of Claude can stop stolen sessions, the malware remains on the infected device and can continue to steal subsequent logins. This underscores a critical point: the infected device, whether personal or corporate, ultimately belongs to the customer. On a work laptop, the enterprise retains control, and endpoint detection solutions, already a standard practice for many security teams, are crucial for catching malware like Vidar or LummaC2 before they can harvest sensitive cookies.
McGladrey observes that the cybersecurity profession’s primary challenge is no longer a lack of technical solutions but rather a deficiency in prioritizing them. He argues that while technical solutions exist for nearly every potential vulnerability, the difficulty lies in determining which ones to implement and when. The responsibility for securing accounts often falls across multiple teams: the endpoint team manages the device, the identity team oversees SSO (which was bypassed in this attack), and the AI governance lead crafts policies that employees may circumvent by using personal accounts. Each team is compensated for addressing specific gaps, leading to a fragmented approach to security.
To address this evolving threat landscape, security leaders must integrate AI account security into their incident response playbooks. When an endpoint alert identifies an infostealer family, all AI service sessions on that machine should be treated as compromised. Enterprises should revoke what they can through their tenant controls and instruct employees to sign out of personal AI accounts until the affected machine is thoroughly cleaned. Furthermore, users must be warned that the very notifications they receive about these compromises can be weaponized as phishing templates. Copycat phishing campaigns impersonating Anthropic have already emerged, using the genuine notification as a pretext to lure users into revealing further sensitive information.
Organizations should actively identify and count personal AI subscriptions being used on managed devices. Browser telemetry, Cloud Access Security Broker (CASB) logs, and expense reports can be invaluable tools for surfacing these sessions and associated payments. A critical step is to prevent personal AI accounts from holding OAuth grants into corporate Google Workspace or Microsoft 365 environments. Both platforms offer administrative controls to restrict third-party app authorization, ensuring that work inboxes can only be accessed by applications authorized by the security team and revocable at their discretion.
Beyond preventing new grants, security teams must revoke existing OAuth grants that Claude may already hold. Simply signing out of Claude invalidates the stolen session but does not revoke the underlying authorization granted to Claude by Google or Microsoft. Administrators need to meticulously review third-party app authorizations in Google and enterprise application consents in Microsoft to identify and remove any live grants that were left behind after a user signed out of Claude.
For heavy users of AI services, migrating them to an organization-managed tenant is paramount. On Team and Enterprise plans, administrators have the authority to control whether connectors can be enabled at all, providing a layer of oversight that is absent in personal subscriptions.
Finally, session binding should be a priority for contract renewals. Google has introduced Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, which binds each session to a private key within the device’s Trusted Platform Module (TPM), rendering copied cookies useless on other machines. While currently limited to Chrome on Windows, the industry needs to push for broader platform support and similar security measures from all major AI providers to mitigate the risk of session hijacking across diverse operating systems and browsers. The incident involving Claude serves as a stark reminder that as AI becomes increasingly integrated into our professional lives, the methods used to protect it must evolve at an equally rapid pace.
