Commodity malware is stealing authenticated browser sessions from Claude AI users and draining their paid accounts, according to a customer advisory Anthropic issued this week. The company named five Windows-based infostealers—Vidar, LummaC2, StealC, RedLine and Acreed—plus Atomic Stealer targeting a smaller number of Mac users. These programs copy locally stored browser passwords, login cookies and credentials after arriving through malicious downloads or apps, then replay the stolen session tokens to hijack accounts and rack up usage charges.
One particular attack campaign, dubbed FakeAgent, delivered a trojanized ClaudeDesktop.exe file through malicious Bing advertisements that appeared when users searched for claude.ai. The fake installer logged 7,100 downloads and compromised at least 29 organizations in just two days. The malware also exploited SKILL.md agent configuration files, which can persist across operating system reinstalls and reintroduce the infection each time Claude loads the poisoned skill documentation. Victims typically noticed the compromise through billing anomalies rather than login prompts—usage limits appeared to refill and then drain while accounts sat idle.
Anthropic was explicit that Claude itself wasn't the infection vector: "We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude." The company told affected users that if usage limits appeared to refill and then empty during periods of inactivity, stolen sessions were likely the cause. Anthropic said it's revoking the compromised sessions, wiping saved payment methods and refunding unauthorized charges tied to the stolen logins, though it cautioned that "signing you out of Claude stops the stolen sessions, but it doesn't remove the malware."
The attack works because session cookies represent an already-authenticated state, allowing an attacker who replays a stolen token to bypass both passwords and two-factor authentication entirely. Traditional multi-factor protections can't stop this method since the cookie itself proves the user already passed those checks. The incident highlights a broader enterprise governance gap: AI accounts with API keys and repository access often sit on unmanaged endpoints that fall outside standard corporate monitoring systems. Anthropic told users to change credentials, revoke active sessions and clean their systems, since logging out of Claude alone doesn't remove the underlying infection from the machine.
The company's advisory marks paid AI usage as one more asset commodity stealers can now monetize, joining the 246 AI security incidents logged in the past 90 days across the industry. Session theft is emerging as the new credential theft precisely because it sidesteps the authentication layers organizations have spent years building. For defenders, the persistence mechanisms—especially configuration files that survive OS reinstalls—mean traditional remediation may no longer be enough, and scanning must happen before any password resets to prevent reinfection. The shift from password-based to token-based compromise requires rethinking endpoint hygiene and session management across the entire AI toolchain.