Session theft hits Claude users
A threat actor deployed an infostealer that scraped browser session data and then used those tokens to log into Anthropic’s Claude accounts.
Why the theft matters
Session cookies are essentially a master key; once an attacker possesses them they can bypass passwords and two‑factor checks, acting as the legitimate user.
How the infostealer operates (what we know)
Verified reports only confirm that the malware harvested session information. Typical infostealers drop a loader that reads cookie stores (e.g., Chrome’s Cookies SQLite file) and exfiltrates them to a command‑and‑control server.
With the stolen tokens the actor was able to open Claude’s web interface and issue prompts as the compromised user.
Who’s at risk
Any Claude user whose session data was captured is potentially exposed. The exact number of victims has not been disclosed.
Defensive steps
- Enable MFA on Anthropic accounts and any linked services.
- Regularly review active sessions and revoke any that look unfamiliar.
- Keep browsers and OS up to date to reduce the attack surface for infostealers.
- Use reputable endpoint protection that can detect credential‑stealing payloads.
- Prefer hardware‑based authentication tokens over software‑only OTP apps.
What to monitor
Watch for outbound traffic to unknown C2 domains from workstations, and set alerts for sudden spikes in Claude login activity from new IP addresses.