Six Infostealers Are Draining Claude Accounts. 2FA Can't Help.

TL;DR

Anthropic has been emailing Claude users to tell them their accounts were hijacked, not by a password breach, but by commodity infostealer malware lifting active login sessions straight out of their browsers. Attackers replay those stolen sessions to access accounts and burn through usage limits. Anthropic's response: force sign-outs on affected accounts, removal of saved payment methods, and refunds for charges it identifies as unauthorized. The company named six malware families: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs. The story surfaced when an affected user posted Anthropic's email to Reddit, and BleepingComputer reported it on August 30.

The symptom was the tell

Affected users noticed something specific before any email arrived: usage limits that appeared to refill on schedule and then drained while they were not using Claude at all. Anthropic's notification confirms that pattern is the fingerprint of this campaign.

From the email: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage."

Anthropic was also explicit about what this is not: "We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude." The infections came the usual way, through malicious downloads. The user who surfaced the story traced their own infection to pirated software.

Why your 2FA never got a vote

Infostealers do not guess passwords. They copy what your browser has already stored: saved credentials, autofill data, and, crucially, the cookies that represent your logged-in sessions. A valid session cookie is proof that authentication already happened, so whoever replays it walks straight into the account. No password prompt, no 2FA challenge, nothing for your authenticator app to intercept.

Think of a session cookie as a festival wristband. The gate checked your ID once, at entry, and clipped the band on. From then on, nobody re-checks the ID, because the wristband is the ID. An infostealer is a pickpocket that slips the band off your wrist without cutting it, and the gate waves the thief through all weekend.

The roster: rental malware, not bespoke tooling

Every family Anthropic named is malware-as-a-service: subscription products criminals rent by the month, with dashboards, support channels, and update cycles. Nobody wrote custom code to attack Claude. The existing stealer economy simply added AI accounts to the list of things worth grabbing from an infected machine, next to bank logins, crypto wallets, and streaming accounts.

LummaC2 is the instructive one. In May 2025, Microsoft, the FBI, and Europol ran a coordinated takedown that seized roughly 2,300 domains, after Microsoft counted more than 394,000 infected Windows machines in a three-month window. Lumma was back within weeks. Fifteen months later it is on Anthropic's list. That is the durability you are up against: these operations treat law enforcement the way a hydra treats a sword.

Why a Claude session is worth stealing

The observable behavior is attackers consuming victims' usage, and the economics write themselves. A hijacked subscription is metered inference someone else pays for, and stealer logs are sold in bulk, so working AI sessions become a line item in an existing market. Your Max plan has joined Netflix logins as resale inventory, which is a milestone of sorts for the industry.

For anyone building on AI accounts, the structural point matters more than this incident: as subscriptions gate more compute, the session tokens that unlock them become higher-value theft targets, and none of the protection you configured at login time applies after login.

What Anthropic did, and what it cannot do

For accounts it identified as compromised, Anthropic revoked the stolen sessions by signing the user out everywhere, stripped saved payment methods so the sessions could not be monetized further, and is refunding charges it identifies as unauthorized. Per Search Engine Journal, affected users keep their current billing period.

The company was equally clear about the limits of that response: "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware." If the stealer is still resident, the next login mints a fresh session and the cycle restarts. Anthropic can invalidate tokens all day; it cannot clean your machine.

One detail from the original Reddit account deserves preservation: the user reported that Windows Defender missed the infection, and that they ended up having Claude Opus detect and reverse-engineer the malware that had been spending their tokens. The account got drained; the irony refilled instantly.

What you should actually do

• Check the symptom. Usage limits that refill and then drain while you are away are the campaign's signature. Unfamiliar conversations in your history are another.
• Revoke sessions yourself. You do not need to wait for Anthropic's email: logging out of all active sessions takes one click in settings, and changing your password after (not before) the malware is gone.
• Treat sign-out as triage, not cure. If a stealer ran on your machine, every browser-stored credential is suspect, not just Claude. Security responders in the thread advised a full system wipe, and infostealers are exactly the case where that advice is not paranoia.
• Audit the download path. This campaign rode pirated software and malicious installers. The machine that holds your agent sessions, API dashboards, and password manager should not be the machine that runs cracked binaries.

Key Takeaways

• Anthropic is force-signing out compromised Claude accounts, wiping saved payment methods, and refunding unauthorized charges after infostealers were caught replaying stolen login sessions.
• Six commodity malware families are involved: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, Atomic Stealer on a small number of Macs.
• Session-cookie theft happens after authentication, so passwords and 2FA offer zero protection once a machine is infected.
• The refill-then-drain usage pattern is the telltale symptom; unfamiliar conversations are a second.
• These are rented malware kits with a history of surviving takedowns; AI subscriptions are now standard inventory in the stolen-credential economy.
• A forced sign-out stops the current theft but not the next one: the malware has to come off the machine, and browser-stored credentials beyond Claude should be considered exposed.

Sources: BleepingComputer, Search Engine Journal, Microsoft On the Issues, Europol, Anthropic Help Center