If you pay for an AI subscription and keep a card on file, there's a specific attack you need to know about right now — and it has nothing to do with a weak password. In late August 2026, Anthropic began emailing affected Claude users to warn them that infostealer malware sitting on their own computers had been used to hijack their logged-in browser sessions, break into their paid accounts, and burn through their usage allowances. Anthropic refunded the fraudulent charges, but the underlying problem isn't a Claude bug — it's a malware infection on the victim's machine, and it works identically against ChatGPT, Gemini, or any other AI subscription you're logged into in a browser.
Anthropic confirmed to affected users (in emails first reported by security outlets between Aug 30 and Sept 1, 2026) that a threat actor used common infostealer malware to steal Claude login sessions and browser cookies directly off victims' computers, then used those stolen sessions to log in as the victim and consume their paid usage. Anthropic's response: force-logout of all active sessions, deletion of saved payment methods on file, and refunds for unauthorized charges. Security researchers identified the malware involved as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer (AMOS) on macOS — all commodity malware sold cheaply on cybercrime forums, unrelated to any Anthropic system.
What Anthropic actually told affected users
The disclosure itself was quiet and personal — not a public breach notice, but a direct email to the specific accounts that showed signs of compromise. Anthropic told those users a threat actor had been logging into their paid Claude accounts using stolen session data, then riding on the victim's own usage allowance and, in some cases, running up charges. Anthropic's remediation was threefold: it signed out every active session on the affected accounts, deleted any payment method saved on file, and identified and refunded the unauthorized charges. Critically, Anthropic was explicit that it has "no reason to believe" the malware came from Claude itself, was installed through Claude, or had anything to do with what the user did inside the product. One affected user described tracing their own infection back to a pirated game they had downloaded, in an account posted to Reddit that security researchers later cited — completely unrelated to their Claude usage.
Why your password and 2FA didn't stop this
This is the part that trips people up, because it breaks the mental model most of us use for account security: strong password plus two-factor authentication equals safe. That model assumes an attacker is trying to log in from scratch — guessing or phishing your password, then getting stopped by a 2FA code sent to your phone. Session-cookie theft skips that step entirely. When you log into Claude (or any web app) in your browser, the site gives your browser a small authentication token — a session cookie — that says "this browser has already proven who it is, let it in without asking again." That's what makes browsing an app pleasant instead of demanding a password on every click. Infostealer malware simply reads that token straight off your hard drive and hands it to an attacker, who loads it into their own browser and is instantly treated as you, already logged in. No password is guessed. No 2FA prompt ever fires, because as far as the server is concerned, you already passed that check earlier — the attacker is just wearing your already-validated session like a stolen keycard.
The malware families behind the attacks
None of this required Anthropic-specific hacking tools. Security researchers at BleepingComputer, Help Net Security, and Malwarebytes traced the activity to a familiar lineup of commodity infostealers — malware built to grab as many browser credentials, cookies, and crypto-wallet files as possible, then get resold or auto-fed into criminal marketplaces. On Windows, the identified families were Vidar, LummaC2, StealC, RedLine, and Acreed. On macOS, it was Atomic Stealer, usually shortened to AMOS. All of these are cheap, widely available on cybercrime forums, and have been used for years against banking logins, gaming accounts, and cloud storage — Claude accounts are just the newest target on an old, well-worn list, not a special case.
Not a Claude problem — every AI account you pay for is exposed
It's worth being precise about what Anthropic actually said here, because it's the most useful part of the disclosure for anyone reading this as a user rather than a security researcher: this is not a Claude vulnerability. Infostealers don't care what website's cookie they're stealing — they scoop up everything sitting in your browser's storage, then whoever buys or uses the stolen data picks through it for anything valuable. A Claude session cookie sits in the exact same browser storage as your ChatGPT session, your Gemini session, your DeepSeek session, your email, and your banking portal. If your machine is infected, every paid AI account you're logged into in that browser is equally exposed, regardless of which company built it or how good their own security engineering is.
| What matters | Stolen password | Stolen session cookie |
|---|---|---|
| Needs your password? | Yes — attacker must know or guess it | No — password is never touched |
| Triggers a 2FA prompt? | Yes, on next login attempt | No — session is already authenticated |
| Stopped by changing your password? | Yes, immediately | No — must also sign out active sessions |
| How it's obtained | Phishing, data breach, guessing | Malware reading files off your own device |
| Fix requires | New password + 2FA | Malware removal + forced sign-out everywhere |
Signing out of a hijacked account only closes the door the attacker already used. If the infostealer is still running on your machine, it will simply grab your next session cookie the moment you log back in — malware removal has to happen first, not as an afterthought.
What to actually do this week
Anthropic's own advice to affected users doubles as a solid checklist for anyone who pays for one or more AI subscriptions and wants to be sure they're not next. None of these steps are Claude-specific — run through all of them across every AI account you use.
- Run a full malware scan with a reputable, up-to-date scanner and remove anything it flags — signing out of accounts without doing this leaves you re-exposed the next time you log back in.
- Check the active-sessions or "devices logged in" panel on every AI account you use (Claude, ChatGPT, Gemini, and any others) and force sign-out of anything you don't recognize.
- Pull up billing history on each account and look for usage or charges you didn't make, then use the vendor's support channel to dispute anything unauthorized.
- Reset passwords and re-enable 2FA on other important accounts — email, banking, cloud storage — since the same stolen session data frequently exposes more than one site at once, not just the AI account.
- Think back on recent downloads: pirated software, cracked games, "free" versions of paid tools, and unofficial browser extensions are the classic delivery route for this exact class of malware.
- Consider removing saved payment methods from AI accounts you don't use daily, so there's less for a hijacked session to spend even in a worst case.
How this differs from the Vercel/Context AI breach earlier in 2026
If this sounds familiar, it's because infostealer malware also played a role in the April 2026 breach that hit Vercel through a third-party AI productivity tool called Context AI — that incident used Lumma Stealer to harvest an employee's cloud credentials, becoming a supply-chain problem affecting infrastructure used by millions of websites. This new wave is a different shape of the same underlying threat: instead of a single employee's stolen enterprise credentials cascading into a company-wide breach, it's individual consumers' personal AI subscriptions and saved payment methods being drained one account at a time. The lesson from both, though, is the same — infostealer malware doesn't discriminate between a $20/month personal subscription and an enterprise API token. It grabs whatever authenticated session it finds and lets the attacker sort out what's valuable afterward.
01Was Claude itself hacked or breached?
No. Anthropic was explicit that it has no reason to believe the malware came from Claude, was installed through Claude, or is related to anything users did inside the product. The malware infects a user's own computer through unrelated means — commonly pirated software or cracked games — and then steals whatever browser session cookies happen to be sitting on that machine, Claude's included.
02If my password is strong and I use 2FA, am I still at risk?
Yes, if your device is infected. Session-cookie theft bypasses passwords and 2FA entirely because it steals an already-authenticated session rather than trying to log in from scratch. A strong password protects you from someone guessing or phishing your credentials; it does nothing against malware reading an active session token directly off your hard drive.
03How do I know if my AI accounts were affected?
Check the active-sessions or account-activity panel on each service for logins or devices you don't recognize, and review your billing history for usage or charges you didn't make. If anything looks off, change your password, force sign-out of all sessions, and contact the vendor's support to dispute unauthorized charges — Anthropic has been refunding confirmed fraudulent usage.
04Does this only affect Claude, or should ChatGPT and Gemini users worry too?
This attack class targets browser session cookies generically — it doesn't matter which AI service's cookie gets stolen. Anyone logged into any paid AI subscription in an infected browser is equally exposed. The Anthropic disclosure is the one that became public, but the underlying malware families (Vidar, LummaC2, StealC, RedLine, Acreed, and AMOS on Mac) are not Claude-specific tools.
05What's the single most effective way to avoid this?
Avoid the infection vector in the first place: don't download pirated software, cracked games, or "free" versions of paid tools, and be cautious with unofficial browser extensions. Infostealers of this kind overwhelmingly arrive bundled with exactly that kind of download — one affected user traced their own infection to a pirated game. Beyond that, run periodic malware scans and check your active sessions on important accounts regularly.
Whatever this incident teaches you about session security, it's also a decent moment to think about how many separate AI accounts you're keeping logged in — and paying for — across different browsers and devices in the first place. LumiChats gives you Claude, GPT, Gemini, DeepSeek, and other leading models under a single login with pay-per-day pricing under $1/day, so there's one account to secure and check, not five scattered subscriptions each quietly holding their own session cookie and saved card. Fewer logged-in accounts means fewer places a stolen session can do damage — good security hygiene and simpler billing tend to point the same direction.
