Anthropic warns some Claude users of info-stealing malware attack

Anthropic recently warned some Claude users that info-stealing malware on their computers stole active Claude login sessions, allowing attackers to access accounts and steal usage data. The company has signed affected users out of Claude, removed saved payment methods, and refunded unauthorized charges.

Info-stealers can copy authenticated browser sessions, bypassing passwords and two-factor authentication. Anthropic says the investigation is ongoing, but the computer was likely infected with common info-stealing malware, unrelated to Claude itself. Such malware typically enters through downloads or malicious apps, stealing credentials like browser passwords and login cookies.

Anthropic identified various malware, including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on some Macs. The company urges affected users to change credentials, revoke other sessions, and remove the malware.