A sophisticated cyberattack utilizing diverse infostealer malware has allowed threat actors to bypass MFA and hijack Claude AI accounts. Anthropic has responded by force-signing out users and refunding unauthorized charges.

  • Threat actors used infostealers like Vidar, Lumma, and RedLine to steal session cookies.
  • Attackers bypassed Multi-Factor Authentication (MFA) by hijacking active sessions.
  • Anthropic proactively signed out affected users and removed saved payment methods to prevent fraud.

In a significant security incident, Anthropic, the developer of the AI assistant Claude, has revealed that a substantial number of its users were targeted by a coordinated campaign of session theft. Unlike traditional phishing attacks that target passwords, this campaign utilized a variety of infostealer malware to harvest session cookies and authentication tokens directly from users' devices.

The breach came to light after affected users received email alerts from Anthropic and subsequently shared their experiences on social media platforms like Reddit. According to the company, the compromise did not stem from a vulnerability within the Claude platform itself, but rather from malware already present on the users' local systems, likely introduced via malicious applications or unofficial software downloads.

Read Also:Kolkata Metro to Go Driverless on Green and Purple Lines – High‑Tech Unmanned Trains

The Malware Arsenal

Anthropic's internal investigation identified a wide array of malware used in the campaign. On Windows systems, the primary culprits were Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed. Mac users were also targeted, albeit on a smaller scale, primarily through the Atomic Stealer (AMOS). These tools are designed to scour browsers for saved credentials and active session IDs, allowing hackers to impersonate users without needing a password.

Why This Matters

BozokMedia analysis shows that this incident marks a critical shift in the cyber-threat landscape. As organizations adopt stronger password policies and mandatory Multi-Factor Authentication (MFA), attackers are pivoting toward Session Hijacking. By stealing a valid session cookie, an attacker can enter an account as an 'already authenticated' user, rendering MFA completely useless. This makes incident response far more complex, as a simple password reset is often insufficient to terminate an attacker's access.

The shift from credential theft to session hijacking represents a fundamental challenge to modern identity security, proving that MFA is not a silver bullet.

To mitigate the damage, Anthropic took the aggressive step of invalidating all suspicious sessions and removing saved payment methods. This prevented the threat actors from incurring further costs on the users' behalf. The company has also issued refunds for any unauthorized charges already processed during the breach.

However, Anthropic warned that signing out is only a temporary fix. If the infostealer remains on the user's machine, the attacker can simply steal the new session token as soon as the user logs back in. Users are strongly urged to perform a full system scan, remove the malware, and update all saved browser passwords.

Did You Know?: Session cookies are small pieces of data stored by your browser that tell a website you've already logged in, which is why you don't have to enter your password every time you refresh a page.

Frequently Asked Questions

Q1: Was my password stolen in the Anthropic attack?
While the primary goal was session theft, most infostealers also harvest saved passwords from browser vaults, so it is highly recommended to change all sensitive passwords.

Q2: Does MFA protect me from this type of attack?
No. Because the attackers steal the session token *after* the MFA check has already been completed, they can bypass the security layer entirely.