Anthropic, the company behind Claude, just confirmed something that should change how you think about AI tool security. Attackers found a way to hijack paid Claude accounts without ever knowing the password, and without 2FA stopping them. Not by breaking encryption. By stealing a browser cookie.
I’ve dealt with a real hack on this exact blog earlier this year, so when I saw this story, it hit differently than the usual AI news. This isn’t abstract. This is the same category of problem, just aimed at a different target.
What Actually Happened
Anthropic identified six separate malware families involved: Vidar, LummaC2, StealC, RedLine, and Acreed targeting Windows machines, plus Atomic Stealer on a smaller number of Macs. None of these are new or built specifically to attack Claude. They’re general-purpose infostealers, the same kind that have been stealing banking logins and gaming accounts for years, sold on dark web marketplaces for as little as $100 a month.
Here’s the part that actually matters. These programs don’t steal your Claude password. They steal your session cookie, the small file your browser keeps that says “this person already logged in, let them through.” An attacker who copies that cookie gets treated as you, already authenticated, no password needed, no 2FA prompt triggered. Your two-factor authentication never even gets asked, because as far as the website’s concerned, you already passed it.
Some affected users noticed their usage limits would refill, then drain rapidly, without them actively using Claude. That was the tell. Someone else was spending their subscription.
Why 2FA Didn’t Stop This
This is the detail worth actually understanding, not just skimming past. Two-factor authentication protects your login. It does nothing once you’re already logged in and your browser is holding a valid session cookie. If malware on your computer copies that cookie, the attacker skips the login screen entirely. They’re not guessing your password or your OTP. They’re walking in through a door you already opened for yourself.
Security researchers are describing this as a real shift industrywide, attackers moving from stealing passwords to stealing sessions specifically because stronger password security and MFA adoption made old-fashioned credential theft harder. This is the workaround.
Where the Malware Actually Comes From
None of this requires anything special targeting AI tools specifically. Anthropic was clear that the malware is general-purpose and typically arrives through a pirated download, a fake installer, or a malicious browser extension. The infection has nothing to do with Claude itself. It’s already on your computer for other reasons, quietly harvesting whatever passwords and cookies it can find, and your AI subscription just happened to be sitting there too.
This is exactly the same category of risk I ran into with a WordPress hack on this blog. Different technical details, same root cause: something got in through an unpatched or unofficial entry point, and it sat there quietly doing damage before anyone noticed something was actually wrong.
What This Actually Means for You
If you or your team use paid AI tools for business, this is now a real business risk, not just a personal one. If someone’s business account gets hijacked this way, you’re not just out the subscription cost. Depending on what’s in your chat history, an attacker could see real business information, client details, or strategy discussions sitting in old sessions.
Watch for the same warning sign Anthropic flagged: usage that refills then drains without explanation. If you or your team notice AI credits disappearing faster than actual usage would explain, that’s worth investigating immediately, not writing off as a billing glitch.
Avoid pirated software and unofficial browser extensions, full stop. This sounds obvious, but it’s exactly how this entire campaign started for affected users. A cracked version of paid software, a browser extension from outside the official store, a “free” tool that seemed too convenient. That’s the actual entry point almost every time.
Signing out isn’t enough if the malware is still on your machine. Anthropic was explicit about this: revoking a stolen session stops that specific theft, but if the malware is still running on your computer, your very next login session can get stolen the same way. If you ever suspect you’re affected, a full malware scan and cleanup has to happen, not just a password change.
Use a password manager, and treat session security as seriously as password security. A password manager won’t stop a cookie theft directly, but reducing password reuse across accounts limits how much damage a single infection can do once it does get in.
Bottom Line
This story matters beyond Claude specifically. It’s a preview of where account security threats are actually heading: attackers going after the session, not the password, specifically because password security has gotten harder to crack the old way. If you use any paid AI tool for real business work, treat unexplained usage spikes as a genuine security signal, keep your software to official sources only, and remember that logging out alone doesn’t fix an infected machine. The malware that stole someone’s Claude session got in through the exact same door that’s been used to steal banking logins for years. AI subscriptions just became worth stealing too.