Session-cookie theft: infostealers drained paid Claude accounts without touching a password

Anthropic spent the weekend signing Claude users out of their own accounts. Malware on those users’ machines had copied a live session cookie, and somebody else was spending the usage limits it unlocked. No password was cracked. No 2FA prompt ever fired.

That combination is what makes session-token theft the account-takeover technique of the moment. A decade of hardening, from password managers to hardware keys, protects the login. The cookie the server hands back afterward protects nothing, and it sits in a file on the local disk. What’s new here is the target. A Claude subscription now carries real metered value, which puts AI accounts in the same tier as banking logins for the people who buy stealer logs.

What Anthropic actually found

Anthropic began emailing affected Claude users on Sunday, August 30, and BleepingComputer published the text of the notice. The tell was a billing pattern rather than a login alert. Usage limits refilled on schedule, then drained while the account owner wasn’t working. “If your usage limits looked like they refilled and then drained while you weren’t using Claude, this was likely the cause,” the email said.

The company named the families it saw. Vidar, Lumma (also written LummaC2), StealC, RedLine and Acreed turned up on Windows, plus Atomic Stealer on a small number of Macs. None of those are bespoke. They’re rented commodity kits sold by subscription on criminal markets, and they’ve been sweeping browser data off consumer machines for years. An infostealer does not know or care that Claude exists. “Your Claude session was likely one of the many things it collected,” the notice said.

On the question of blame, Anthropic was direct. “We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude,” the email read, and phones and tablets do not appear to have been involved. The infections trace back to unofficial downloads and malicious apps, the same route these kits have always taken.

Three things happened on Anthropic’s side. It signed the compromised sessions out, deleted the saved payment method on each affected account, and refunded charges it identified as unauthorized. “Our systems detected this activity on your account, and we’ve therefore removed your card on file and signed out the sessions involved,” the notice read, per Security Affairs. SecurityWeek reported that the company warned it may sign users out again if it detects further misuse.

Why a stolen cookie beats 2FA

Two-factor authentication guards a door the user already walked through. A successful login ends with the server issuing a session cookie, and every request after that carries the cookie instead of the password. Claude’s web sessions last 28 days of inactivity, and any activity pushes the expiry out another 28 days from that point. An attacker holding the cookie therefore inherits a month of access that renews every time they use it.

Stealers go straight for that file. A modern kit walks the browser profile directory, pulls the cookie database and the saved-password store, then uploads the lot as a single archive. The Cyber Express describes the haul as browser credentials, autofill data and authentication cookies. That archive is the product. It gets indexed and sold, which is also why the same logs feed carding markets, since the autofill rows sit right next to the cookies.

Replay is the whole attack. The stolen cookie goes into a fresh browser profile, usually behind a proxy in roughly the victim’s geography, and the service sees a returning user. No password prompt. No push notification. Nothing in the login history either, because there was no login.

The class matters more than this one incident. Anything that keeps a user signed in across restarts, which is nearly every service a developer touches, carries the same exposure, and MFA does nothing about it. Password rotation doesn’t help either, since the cookie was issued before the rotation and stays valid until something explicitly revokes it.

Why a Claude subscription is worth stealing

Claude Pro costs $20 a month, and Max starts at $100 for either 5x or 20x Pro’s usage. A hijacked Max session is a metered pool of frontier-model inference that refills on a schedule and bills someone else. That has a wholesale price, and it clears well above what a stolen streaming login fetches.

The channel to move it already exists. Matt Lenhard’s investigation into the 49-relay market reselling OpenAI and Anthropic tokens found frontier access priced as much as 97.8% below list, with the underlying key pools filled by bulk free-trial signups, chargebacks and virtual cards. A token relay does not care whether a credential was bought or lifted. It cares that the credential still bills a third party.

IBM put a number on the wider pattern six months before Anthropic’s notice went out. Its 2026 X-Force Threat Index, published February 25, found that infostealer malware exposed more than 300,000 ChatGPT credentials during 2025, and concluded that AI platforms “have reached the same credential risk as other core enterprise SaaS solutions.”

The economics also explain the shape of this theft. Anthropic described attackers consuming usage rather than staging a wider intrusion, and burning metered spend is the fastest way to turn a stolen session into money before the owner notices. Whether anything was read along the way is a question the notice doesn’t answer, and that silence is the part worth sitting with if the account held work under NDA.

Cleaning up in the right order

Order matters more here than any individual step. Anthropic’s own remediation list starts with removing the malware, because credentials rotated on a still-infected machine get stolen again on the next upload. “Signing you out of Claude stops the stolen sessions, but it doesn’t remove the malware,” the notice said.

• Clean the device first. Run a full scan with the platform’s own tooling, and rebuild if the scan finds an active stealer.
• Rotate the email account next. New password, 2FA enabled, because that inbox is the recovery path for everything else.
• Terminate live sessions in Settings, then Account, where Claude lists each device, browser, approximate location and last-active time.
• Re-add a payment method only after the machine is clean, and read the card statement for anything the browser had stored.
• Sign out and back in everywhere else, since one archive holds cookies for every site that browser was logged into.

Spend alerts are the piece developers skip. Consumer Claude plans don’t bill by the token, so the only signal is a usage bar rather than an invoice, which makes the bar worth watching. A limit that empties overnight is exactly the alarm the email described. On the API side, a per-workspace cap turns the same failure into a bounded loss instead of an open tab.

Why you’re hearing about this now

Session theft became the standard workaround once MFA got common, AI subscriptions turned into a metered asset with a resale price, and a discount relay market grew up to move the goods. Those three curves crossed in the last year, and the August 30 notice is the first time a major lab has emailed its own customers about the result. Being first to say it out loud isn’t the same as being first hit. The legal grey zone around who gets to poke at AI labs is a separate argument, and this is the mundane version underneath it: ordinary crimeware, an ordinary cookie, a bill that lands on someone else.

My read: treat a long-lived session cookie on a developer machine as a credential with no expiry and no second factor, and audit it like one. Check the active-session list on the services that offer it, and set a calendar reminder to do it again in a month. If the next notice of this shape comes from an API provider rather than a chat subscription, the damage won’t stop at a drained usage bar.