Anthropic didn’t get breached. Its users did, and that distinction matters more than it might seem. The company has begun notifying Claude users that infostealer malware on their own machines allowed attackers to steal active session cookies, slip into their accounts undetected, and burn through usage limits. According to SecurityWeek, Anthropic detected the suspicious activity, logged out compromised sessions, and removed saved payment methods from affected accounts as a precaution.
The malware families involved are well-known in threat intelligence circles: Vidar, Lumma, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) hitting a smaller number of macOS machines. None of these are new. Lumma and Vidar have been circulating for years, sold as subscription-based tools on criminal forums. They don’t exploit anything in Claude or Anthropic’s infrastructure. They sit quietly on a compromised device, pull saved passwords, session cookies, and local credentials, then send everything to an attacker-controlled server. Someone then sorted through that harvested data specifically looking for Claude sessions worth monetizing.
That targeting detail is significant. It tells you Claude accounts have enough perceived value, whether for reselling API access or running automated tasks at scale, that criminals are now fishing for them explicitly. OpenAI has dealt with similar account-takeover activity, and as AI subscriptions become a standard line item for professionals and businesses, this attack surface will only grow. Infostealer logs traded on dark web markets already contain credentials for hundreds of SaaS platforms. Claude is now on that list.
Anthropic’s response was reasonable given what it could actually control. The company refunded charges it identified as unauthorized, warned it may log users out again if misuse continues, and told affected customers not to re-add payment information until they had fully cleaned their machines. That last point is the right call, because re-entering a credit card on a still-infected device just hands the attacker fresh billing data.
For developers and teams using Claude through the API or Claude.ai, this is a good moment to review a few basics:
- Audit active sessions in your account settings and revoke anything unfamiliar
- Use a password manager with phishing-resistant credentials rather than browser-saved passwords
- Enable any available login alerts or anomaly notifications
- Treat any unexpected drop in usage limits as a potential indicator of compromise
The broader takeaway is that AI platform security is increasingly tied to endpoint security. Anthropic can build all the account protections it wants, but if a user’s browser is compromised, those protections have a hard ceiling. For enterprise teams especially, this reinforces why device management and endpoint detection matter as much as the platform policies your AI vendor publishes.
