Anthropic has begun forcibly signing out Claude users after commodity infostealer malware already sitting on their own computers copied active login sessions and handed them to an outside attacker. The company confirmed the campaign in emails to affected users, and it is removing saved payment methods and refunding charges it identifies as unauthorized. The mechanism matters more than the malware names: a valid session token is functionally a login, and two-factor authentication never gets asked to defend it.
This did not happen inside Anthropic’s infrastructure. The theft occurred on the users’ own machines, where general-purpose stealer malware, the kind that also grabs browser passwords and cookies for dozens of other sites, picked up the Claude session along with everything else. Anthropic said it has no reason to believe the malware is connected to Claude, installed through Claude, or tied to anything the user did inside the product.
The account-side fixes carry a real limitation that Anthropic itself flags: signing a user out invalidates the stolen session, but it does not touch the infection that stole it. A machine that is still compromised can hand over a fresh session the next time its owner logs back in. Anthropic’s guidance to affected users puts malware removal first, before any password reset or new payment method, precisely because skipping that step leaves the door open again.
Security teams have spent a decade training people to treat passwords as the asset worth guarding and 2FA as the backstop when a password leaks. A session token gets none of that attention. It sits in a browser’s cookie store, unencrypted enough for local malware to read, and once copied it behaves exactly like an authenticated user to any service that checks it, no password prompt required. That gap is now the more attractive target than the login screen itself.
It is also a gap every AI subscription shares. Claude, ChatGPT, Gemini and every other paid assistant now carry saved payment details and, increasingly, a metered usage balance that a stolen session can burn through before anyone notices. A subscription that used to be worth stealing only for its output is now worth stealing for its billing relationship too, which changes the incentive for the people writing this malware.
Help Net Security reported that the malware families Anthropic named in its notifications include Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows machines, plus Atomic Stealer on a small number of Macs, all commodity tools already circulating well outside any AI context. One affected user, posting on Reddit, traced their own infection to a pirated game downloaded from a Russian forum, a reminder that the entry point is usually mundane rather than exotic.
Anthropic also warned that copy-cat emails impersonating its own suspension notice are likely to follow, using the real campaign as cover for a second wave of phishing.
Claude users should treat an unexpected sign-out notice as a signal to run a malware scan before doing anything else, including resetting a password, since a reset performed on an infected machine can be captured again immediately. Anyone who stores payment details in a browser on a shared or personal device should also check card statements now rather than after the next renewal, and should not assume that 2FA on an account makes its active session immune to what already runs on the hardware underneath it.
Help Net Security first reported the account lockouts on 31 August 2026.
