Anthropic recently confirmed that a wave of Claude accounts were compromised, not through a breach of their own systems, but through infostealer malware sitting on users’ own devices. This is a great case study in how session hijacking actually works, and why it’s more dangerous than simple password theft.
What happened
Infostealer malware (Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, Atomic Stealer on Mac) copied active Claude login sessions directly from users’ browsers. Attackers reused those session cookies to access accounts and burn through paid usage, all without needing a password or triggering 2FA.
Why session theft bypasses 2FA
Two factor authentication protects the login step. But once you’re authenticated, your browser holds a session cookie so you don’t have to log in on every request. Malware that steals this cookie inherits an already-authenticated session, completely skipping the login flow that 2FA protects.
This matters for any long-lived session, not just Claude. Any tool you stay logged into across a browsing session is theoretically exposed to the same attack pattern if the device itself is compromised.
What Anthropic did
- Signed out compromised sessions
- Removed saved payment methods
- Refunded unauthorized usage charges
Practical takeaways for developers
If you handle authentication in your own applications:
- Consider shorter session lifetimes for sensitive actions
- Detect anomalous session reuse (IP/device fingerprint changes mid-session)
- Educate users that 2FA alone doesn’t protect against session theft
Full write-up with more detail: aiwebreporter.com