Anthropic Warns Claude Users of Infostealer Malware Infections

Anthropic detected that infostealer malware infections on some Claude users' computers allowed attackers to steal credentials and session cookies, enabling unauthorized access to Claude AI accounts. The malware families involved include Vidar, Lumma, StealC, RedLine, Acreed on Windows, and Atomic Stealer on macOS. Using stolen session data, threat actors hijacked Claude sessions, leading to unauthorized usage and charges. Anthropic mitigated the issue by signing out compromised sessions, removing saved payment methods, and refunding unauthorized charges. The malware is general-purpose and not specifically targeting Claude, typically delivered via unofficial downloads or malicious apps. Users are instructed to ensure malware removal before restoring payment methods.

Unauthorized actors gained access to Claude AI user accounts by exploiting stolen credentials and session cookies from infostealer malware infections. This led to hijacked sessions, unauthorized usage of Claude services, and fraudulent charges on user accounts. Anthropic mitigated financial impact by refunding unauthorized charges and prevented further misuse by logging out affected sessions and removing saved payment methods.

Anthropic has taken active measures by logging out compromised sessions, removing saved payment methods, and refunding unauthorized charges. Users affected are advised to thoroughly remove infostealer malware from their devices before re-adding payment methods to prevent further unauthorized access. Since the malware is not tied to Claude itself but to infected user devices, remediation focuses on endpoint malware removal. Anthropic may log out users again if misuse is detected.