--- title: Infostealer malware is hijacking Claude sessions to burn... description: Anthropic is alerting Claude users that infostealer malware families - Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer on Mac - are... canonical: https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Infostealer malware is hijacking Claude sessions to burn through users' paid usage | daily.dev og:description: Anthropic is alerting Claude users that infostealer malware families - Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer on Mac - are... og:url: https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t og:image: https://api.daily.dev/og/posts/RIbQubb3T.png og:image:alt: Infostealer malware is hijacking Claude sessions to burn through users' paid usage og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Infostealer malware is hijacking Claude sessions to burn through users' paid usage **[Collections](https://daily.dev/sources/collections)** · 1 min read · 1 upvotes · 1 comments ## Summary Anthropic is alerting Claude users that infostealer malware families - Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer on Mac - are stealing authenticated browser sessions from infected machines, letting attackers hijack Claude accounts and burn through paid usage without needing passwords or bypassing 2FA. Anthropic clarifies this is not a Claude vulnerability but a compromise of the underlying machine. For affected accounts, Anthropic is signing users out, removing saved payment methods, and refunding unauthorized charges. Users are advised to run a full malware scan and remove the infection first, then change credentials, then revoke other sessions - in that order, since resetting credentials before cleaning the machine just leads to them being stolen again. ## Content Anthropic is warning affected Claude users that infostealer malware has been stealing active browser sessions from infected machines, letting attackers hijack accounts and drain usage limits without ever needing a password or bypassing two-factor authentication. Because the sessions were already authenticated, the stolen cookies are enough to get in. The malware families involved include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on Mac. Anthropic is clear that none of this is a Claude vulnerability - the malware operates entirely outside of Claude itself, compromising the underlying machine and lifting session tokens from the browser. For affected accounts, Anthropic says it's signing users out, removing saved payment methods, and refunding unauthorized charges. If you think you're affected, the important thing to understand is that signing out alone doesn't fix anything. The malware is still on the machine. The actual steps worth taking: - Run a full malware scan and remove the infection first - Change your credentials after the machine is clean - Revoke any other active sessions Doing those in the wrong order just means fresh credentials get stolen again. ## Questions this post answers ### How is infostealer malware hijacking Claude accounts without a password? The malware steals already-authenticated browser session cookies directly from infected machines, so attackers can hijack the account without needing a password or bypassing two-factor authentication. Malware families involved include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on Mac. This is not a Claude vulnerability; the machine itself is compromised. _Anyone managing AI account security can follow ongoing infostealer and session-hijacking coverage on daily.dev._ ### What should I do if my Claude account was hijacked by session-stealing malware? Run a full malware scan and remove the infection before doing anything else, since signing out alone does not fix the underlying compromise. Only after the machine is clean should credentials be changed, followed by revoking other active sessions. Doing these steps out of order just lets an infected machine steal the fresh credentials again. _daily.dev surfaces practical incident-response steps for developers dealing with account compromise._ ## Community discussion Top comments from developers on daily.dev. **@wxtx** · 0 upvotes > Good to know. ## Similar posts on daily.dev - ['Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft](https://daily.dev/posts/claudy-day-trio-of-flaws-exposes-claude-users-to-data-theft-oxmixvsef) · Dark Reading · 8 upvotes · 0 comments - [Claude in Chrome is taking orders from the wrong extensions](https://daily.dev/posts/claude-in-chrome-is-taking-orders-from-the-wrong-extensions-fxzui5dan) · CSO Online · 1 upvotes · 0 comments - [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign](https://daily.dev/posts/threat-actors-abuse-claude-ai-shared-chat-for-clickfix-malvertising-campaign-zdoc6dupj) · Trend Micro · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic) [View this post on daily.dev](https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Infostealer malware is hijacking Claude sessions to burn through users' paid usage","url":"https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t"},"datePublished":"2026-08-31T16:08:51.228Z","dateModified":"2026-09-13T19:32:24.131Z","description":"Anthropic is alerting Claude users that infostealer malware families - Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer on Mac - are...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11dcbd434420e2a304f2cd1471de90a2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/11dcbd434420e2a304f2cd1471de90a2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,claude,anthropic","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Infostealer malware is hijacking Claude sessions to burn through users' paid usage"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t","comment":[{"@type":"Comment","text":"Good to know.","datePublished":"2026-08-31T18:10:34.172Z","url":"https://daily.dev/posts/RIbQubb3T#c-y1kkereCo","author":{"@type":"Person","name":"WojtekXTX","url":"https://daily.dev/wxtx","image":"https://media.daily.dev/image/upload/s--slav3kNg--/f_auto/v1788199427/avatars/avatar_y6NTB6llakYmLSelD0bZh?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/infostealer-malware-is-hijacking-claude-sessions-to-burn-through-users-paid-usage-ribqubb3t#faq","mainEntity":[{"@type":"Question","name":"How is infostealer malware hijacking Claude accounts without a password?","acceptedAnswer":{"@type":"Answer","text":"The malware steals already-authenticated browser session cookies directly from infected machines, so attackers can hijack the account without needing a password or bypassing two-factor authentication. Malware families involved include Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on Mac. This is not a Claude vulnerability; the machine itself is compromised. Anyone managing AI account security can follow ongoing infostealer and session-hijacking coverage on daily.dev."}},{"@type":"Question","name":"What should I do if my Claude account was hijacked by session-stealing malware?","acceptedAnswer":{"@type":"Answer","text":"Run a full malware scan and remove the infection before doing anything else, since signing out alone does not fix the underlying compromise. Only after the machine is clean should credentials be changed, followed by revoking other active sessions. Doing these steps out of order just lets an infected machine steal the fresh credentials again. daily.dev surfaces practical incident-response steps for developers dealing with account compromise."}}]} ```