If your Claude usage limits reset and then quietly emptied while your laptop was closed, you now have an explanation, and it is not a good one.
Anthropic began contacting affected users on August 30 after determining that infostealer malware running on those users’ own computers had lifted their active Claude login sessions. The attackers then replayed those sessions to get into the accounts and burn through paid usage. No password was cracked. No two factor code was intercepted. The attackers simply arrived holding a valid ticket.
The short version
- What happened: infostealer malware on users’ machines stole active Claude session cookies, letting attackers access accounts and consume paid usage
- When: Anthropic started reaching out to impacted users on August 30, 2026
- Why 2FA did not help: a session cookie is proof you already logged in, so replaying it skips the password and the second factor entirely
- Anthropic’s response: signing affected users out, stripping saved payment methods, and refunding charges it identifies as unauthorized
- The important caveat: the malware has nothing to do with Claude. It was already on the machine, and it took everything else too
Why a stolen cookie beats a stolen password
Most people picture account theft as someone guessing or phishing a password, then getting stopped by a six digit code. That model is roughly a decade out of date.
When you log in successfully, the service hands your browser a session token, stored as a cookie. That token is the answer to the question “has this person already proved who they are?” For as long as it stays valid, your browser presents it on every request and the service accepts it without asking anything further. That is the entire point. Nobody wants to type a 2FA code on every page load.
Infostealers understand this perfectly. They do not bother with your password vault first. They scrape the cookie jar, because a live session cookie is worth more than a password: it is a password that has already been through the security checkpoint. Export it, load it into a browser on the other side of the world, and the service sees a returning user.
The software doing this is not new, and not aimed at Claude
Anthropic named the malware families it saw in the campaign, and none of them will surprise anyone who follows this space. On Windows: Vidar, Lumma (also written LummaC2), StealC, RedLine and Acreed. On a small number of Macs: Atomic Stealer, usually shortened to AMOS.
These are commodity products. They are rented out, updated on a schedule, and sold with support. Their whole business model is to land on a machine, vacuum up everything credential shaped in a few seconds, and ship it to a marketplace where the results get sorted and resold. Claude sessions are simply a line item that has become worth money.
Anthropic was explicit that this is not a Claude problem in origin, saying it has “no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude.” That is worth repeating, because the headline naturally reads as an Anthropic breach and it is not one. Anthropic’s systems were not compromised. Individual users’ computers were.
The infection routes are the depressingly familiar ones: pirated software, cracked applications, sketchy installers, and the general category of downloads that promise something expensive for free.
| Malware family | Platform seen in this campaign | What it goes after |
|---|---|---|
| Vidar | Windows | Cookies, saved passwords, crypto wallets |
| Lumma (LummaC2) | Windows | Browser credentials and session tokens |
| StealC | Windows | Browser data, app credentials, files |
| RedLine | Windows | One of the longest running credential stealers |
| Acreed | Windows | Newer entrant in the same market |
| Atomic Stealer (AMOS) | macOS, small number of cases | Keychain items, browser data, wallets |
What Anthropic can do, and where its reach ends
The company is signing affected users out, which invalidates the stolen tokens. It is removing saved payment methods, which stops a hijacked account from quietly buying more capacity. And it is refunding charges it can identify as unauthorized.
That is a reasonable response, and it is also the outer limit of what any service provider can do here. Anthropic can revoke its own sessions. It cannot revoke the sessions of every other site whose cookies were sitting in the same browser profile, and it cannot remove the malware that took them.
This is the part that gets lost when a story like this gets filed under the name of one company. If an infostealer ran on your machine and got your Claude session, it did not stop there. It took your email session, your cloud storage session, your password manager if it was unlocked, your saved browser passwords, and anything else within reach, all in the same pass. Claude is the alarm that happened to go off, because Anthropic noticed anomalous usage patterns and told people. Most services never notice, and never call.
If you got one of these emails, do these in order
- 1. Clean the machine first. Changing passwords on an infected computer just hands the new ones over. Run a full scan with a reputable tool, and consider a clean reinstall if you cannot account for how it got there
- 2. Then sign out everywhere. Not just Claude. Use the “sign out of all sessions” option on email, cloud storage, social accounts and anything financial
- 3. Then rotate passwords. In that order, and prioritize the account that can reset all the others, which is almost always your email
- 4. Check payment methods and billing history on every subscription, not only the one that flagged it
- 5. Move to passkeys where you can. They do not eliminate session theft, but they remove the reusable password underneath it
The uncomfortable part
AI subscriptions have quietly become a theft target with real resale value. A hijacked account with a generous usage tier is a metered resource someone else can sell access to, which is a cleaner business than most credential fraud. There is no card to charge back, no shipping address, and the victim often does not notice for weeks because the only symptom is a progress bar moving faster than it should.
Expect this category to grow. The usage limits themselves keep expanding, which raises the value of a stolen seat, and the frontier models have become genuinely expensive to run. We wrote recently about how much compute the current generation of models can consume when you let them work at length, and that compute is precisely what a hijacked subscription is buying for free.
The defensive advice has not changed much, which is its own kind of frustrating. Most of these infections still trace back to something the user downloaded and ran. The systems built to catch a stranger logging in from an unusual country do not fire when the stranger arrives carrying your session. It is the same structural problem behind a lot of recent consumer security guidance, including the router advisories that told everyone to reboot and left the harder half unsaid.
The honest read
This is not an Anthropic breach, and framing it as one gets the lesson backwards. It is a reminder that the browser session has quietly become the real credential, that two factor authentication protects the front door while the cookie jar sits by an open window, and that a service telling you it happened is doing more than most.
If you received a notice, treat it as information about your computer rather than information about Claude. The account was the symptom. The machine is the problem, and it is still yours to fix.
