A new security warning from Anthropic has put Claude users on alert after the company identified a campaign involving information-stealing malware. The threat is particularly concerning because attackers may not need a user’s password or even their two-factor authentication code to access a compromised Claude account.
Claude users whose Windows or Mac computers may have been infected are being warned about possible stolen login sessions. Anthropic says attackers have been using stolen sessions to access accounts and consume the victims’ available Claude usage limits.
The situation highlights a bigger cybersecurity problem that is becoming increasingly difficult for ordinary users to notice. Modern malware does not always behave like the old-fashioned viruses that slowed computers down or displayed obvious warnings. Some malicious programs quietly collect browser data, saved credentials, cookies and active login sessions while remaining largely invisible.
Why Anthropic Sent The Warning
Anthropic has reportedly started contacting users whose account activity appeared unusual. One of the warning signs was a pattern where a user’s usage allowance appeared to become available again and then disappeared even though the person was not actively using Claude.
That unusual behaviour can be a strong indication that someone else has obtained access to the account. In this case, Anthropic believes stolen authentication sessions may have been responsible.
The company has taken protective action for users it believes could be affected. Those measures include signing users out of Claude and removing stored payment information from their accounts.
Anthropic may also refund charges that it determines were generated without the user’s authorisation. This is important because an attacker using a stolen session could potentially consume paid AI resources without the legitimate account holder immediately realising what happened.
How Infostealer Malware Works
The malware involved in this incident belongs to a category commonly called infostealers. Their primary purpose is not necessarily to destroy files or make a computer unusable.
Instead, they quietly search for valuable information.
That can include saved passwords, browser cookies, authentication tokens and credentials stored by applications. Information collected from a compromised machine can then be sent to criminals operating the malware campaign.
Browser session information is especially valuable because it can sometimes allow criminals to enter an account without knowing the actual password.
This is also why two-factor authentication is not always enough when a computer itself has already been compromised. If an attacker steals an authenticated session after the user has successfully logged in, they may be able to reuse that session without going through the normal login process again.
Claude Account Sessions Became Targets
Anthropic’s warning suggests that Claude login sessions were not necessarily the original target of the malware.
Instead, the stolen Claude session could simply have been one piece of information collected from an infected computer. Attackers later began identifying useful Claude sessions among the data they had obtained.
This makes the incident different from a conventional breach of an AI company’s servers.
Anthropic has stated that it has no reason to believe Claude itself caused the infection. The company also said there is no indication that the malware was installed through Claude or connected to something users did while using the service.
That distinction matters because users might otherwise assume that simply using the AI service caused their computer to become infected.
Which Malware Families Are Involved
The investigation has identified several known infostealer families associated with the activity.
On Windows computers, the malware names mentioned include Vidar, LummaC2, StealC, RedLine and Acreed. These malware families are designed to collect sensitive information from infected systems.
A smaller number of Mac computers have also reportedly been associated with the activity. In those cases, Atomic Stealer, commonly known as AMOS, has been identified.
The presence of several malware families suggests that users should not focus on detecting one specific malicious program. A broader security check is more appropriate because different infections can steal similar types of information.
Windows And Mac Users Should Pay Attention
The warning is particularly relevant for people who regularly download software from unofficial websites. Infostealers commonly reach computers through malicious applications, fake installers, cracked software and other untrusted downloads.
A program can appear completely legitimate while secretly installing additional malicious components.
Once installed, the malware can operate quietly in the background. That makes traditional signs such as pop-ups or dramatic performance problems unreliable indicators.
Mac users should not assume that their devices are automatically protected either. Although the reported number of affected Macs appears smaller, the identification of AMOS shows that information-stealing malware also remains a threat for Apple’s desktop platform.
Phones and tablets do not appear to have been involved in the activity described by Anthropic, according to the company’s current assessment.
Signing Out Is Not Enough
One of the most important points in Anthropic’s warning is that simply signing out of Claude does not solve the underlying problem.
If the malware remains active on the computer, a newly created login session could potentially be stolen again.
That means users need to deal with the infected device first rather than repeatedly changing account settings while continuing to use a compromised machine.
Users who receive a warning should scan the computer with reputable security software and follow appropriate malware-removal procedures before returning to normal account activity.
For serious infections, professional technical assistance may be safer than attempting to remove sophisticated malware manually.
What Affected Users Should Do
Anyone who believes their computer may be compromised should take several security steps.
First, scan the affected computer for malware and make sure the security software is updated. Removing the infection is important because stolen credentials can continue to be collected while malicious software remains active.
Next, users should protect the email account connected to Claude. Changing the email password, signing out of other devices and enabling two-factor authentication can help reduce further account exposure.
Other important passwords should also be reviewed.
This includes accounts connected to banking, workplaces, cloud storage and other important online services. If the infected browser contained saved financial information, users should carefully review recent card and bank transactions for anything suspicious.
Payment information deserves particular attention because stolen browser data can contain more than AI account credentials.
Anthropic has also advised affected users to wait until their computer and associated accounts are secured before adding payment information back to Claude.
Why AI Accounts Are Becoming Valuable
The incident also shows why AI accounts are increasingly attractive to cybercriminals.
AI services can have valuable paid usage limits, business information, conversation histories and access to developer tools. For some users, an AI account can also be connected to work projects, programming environments and other digital services.
An attacker who gains access therefore may find more value than simply sending spam messages.
For developers especially, compromised AI accounts could potentially be used to consume large amounts of computing resources or perform activity that appears to come from the legitimate account holder.
That makes account security increasingly important as AI tools become part of everyday work.
The Bigger Cybersecurity Lesson
The latest warning is another reminder that cybersecurity is no longer only about protecting passwords.
A strong password can still become ineffective if a malicious program steals an authenticated browser session from the computer where that password was already used.
Users should therefore think about device security, browser security and account security as connected layers.
Downloading applications only from trusted sources, keeping operating systems updated, avoiding suspicious files and using multi-factor authentication can reduce exposure. Users should also regularly review active sessions and account activity where those controls are available.
Businesses face an even bigger challenge because employees may use AI services alongside sensitive company information.
A compromised employee computer can potentially expose credentials, documents and other digital resources far beyond one personal account.
Claude Users Should Stay Alert
The Anthropic warning does not mean that every Claude user has malware on their computer. It specifically concerns users whose activity or devices may match indicators associated with the infostealer campaign.
Still, unusual account behaviour should never be ignored.
If Claude usage suddenly falls despite limited activity, unexpected charges appear, or account sessions behave strangely, users should investigate rather than simply assuming there is a billing or technical problem.
The most important point is that the AI service itself is not being described as the source of the infection. The current concern is that malware already present on certain computers may have stolen Claude authentication sessions.
Final Takeaway
The latest warning around Claude users demonstrates how quietly modern malware can turn an ordinary computer into a gateway for account theft. Infostealers can collect browser sessions and credentials without producing obvious signs, creating risks that extend beyond a single AI account. Users should scan potentially infected devices, secure their primary email accounts, change important passwords, enable two-factor authentication and monitor financial activity carefully. As AI platforms become increasingly important for personal and professional work, protecting the device behind the account is just as important as protecting the account itself. Stay cautious with downloads, keep security tools updated and investigate unusual account activity immediately.
Read More :- globe-wander.com
