Anthropic Signs Out Claude Users After Infostealer Session Thefts

Anthropic signed an unknown number of Claude users out of their accounts after a threat actor used infostealer malware to steal login sessions and access paid usage, Dark Reading reports.

The company told affected users that the malware was on their own systems and was not related to Claude. Anthropic said the campaign involved Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer on a small number of Macs.

Anthropic removed saved payment methods from affected accounts and said it refunded unauthorized charges where attackers had used a payment card for Claude usage. Signing users out invalidated the stolen sessions used to access the accounts.

The company advised affected users to remove the malware before signing back in, then secure the email account used for Claude by changing the password, signing out other devices, and enabling 2FA. It also told users to update other saved browser passwords before adding a payment method back to Claude.