Infostealer Malware Targets Claude Users as AI Compute Becomes Black-Market Currency

Anthropic is forcing Claude users out of their accounts and erasing saved payment cards after confirming that infostealer malware has been systematically stealing browser session credentials and selling access to those accounts on underground markets — where a hijacked Claude subscription can generate more than $100,000 a day in unauthorized inference charges before anyone notices.

The company disclosed the campaign in a direct email sent to affected users this week, stating that "a bad actor is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage." Anthropic identified six malware families active in the campaign: Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, along with Atomic Stealer on a smaller number of Macs, according to BleepingComputer's reporting on the Anthropic email.

Changing Your Password Won't Fix This

The attack mechanism explains why Anthropic is responding with forced logouts rather than password resets, and why users who have already changed their passwords may still be at risk. The attack does not target passwords or authentication codes at all.

When a user successfully logs into Claude — including passing two-factor authentication — the browser stores a session cookie: a unique token that proves the authentication already happened. Every subsequent request to Claude servers sends that cookie rather than re-prompting for credentials. The cookie is stored in a local database on the user's computer.

Infostealer malware reads that database, decrypts the stored cookies using the same operating system tools that the browser uses, packages every authenticated session it finds across all websites, and transmits them to attacker-controlled infrastructure — typically within minutes of infection. The attacker then loads the stolen Claude session cookie into their own browser or automated scripts. The Claude server sees a valid, authenticated session. No password is required. No two-factor code is triggered. The attack completely skips the authentication step because authentication already happened on the victim's machine.

Security researchers call this a pass-the-cookie attack, and it has become the dominant account-takeover technique of 2025 and 2026. Session hijacking attacks increased 127 percent year over year in 2026, according to data from Obsidian Security. The fundamental mismatch: MFA protects the moment of login; it does nothing to protect what happens after login.

Six Malware Families, One Underground Paycheck

The six infostealer families Anthropic identified represent different corners of the same criminal ecosystem.

LummaC2 is the most technically sophisticated of the group. First appearing on Russian-language cybercrime forums in late 2022, it operates as a Malware-as-a-Service subscription at $250 to $1,000 per month, offering buyers a management panel, browser data harvesting, cryptocurrency wallet theft, and active evasion of antivirus detection through in-memory execution and process hollowing. The FBI estimates Lumma has been involved in roughly 10 million infections globally, with losses linked to the malware exceeding $36 million in 2023 alone. A coordinated action by the Department of Justice, Microsoft, and Europol seized approximately 2,300 Lumma-associated domains in May 2025 — and Lumma's operators rebuilt their infrastructure within weeks. Microsoft documented a new Windows Terminal-based delivery variant as recently as March 2026.

Vidar, older but still active, had emerged as the leading infostealer on the Russian Market underground marketplace by late 2025, filling the gap left when LummaC2's infrastructure was disrupted. RedLine was dismantled by Dutch police and the FBI in October 2024 under Operation Magnus, with developer Maxim Rudometov charged in the United States — yet the logs it collected during its years of operation continue to circulate on underground markets, meaning credentials stolen before the takedown remain actively exploitable.

StealC and Acreed represent the current generation of replacement families. Acreed is particularly notable: first observed on February 10, 2026, it uploaded more than 4,000 credential logs in its first week of operation, rapidly outpacing more established competitors. Atomic Stealer targets macOS through fake application updates and cracked software, extracting Keychain data and browser cookies from a platform that many users incorrectly assume is immune to credential theft.

The Economics of Stolen AI Compute

The specific targeting of Claude accounts reflects a structural shift in what cybercriminals consider worth stealing. Traditional infostealer use cases centered on banking credentials, cryptocurrency wallets, and corporate logins for ransomware access. AI subscriptions are now in that same tier.

The motive is arbitrage. Claude Pro, Team, and API access are expensive and geographically restricted. Anthropic bars Chinese-controlled entities from access and requires government ID verification for new subscriptions. These restrictions create a price differential that a criminal ecosystem exploits. An account generating $20 or $200 a month in legitimate subscription fees can produce far larger value when its session is packaged and resold through proxy networks — a practice researchers call LLMjacking.

Sysdig's threat research team, which coined the term, documented that a single hijacked account with access to Claude through AWS Bedrock could generate over $46,000 per day in inference costs to the victim at maximum quota limits for older model versions. For Opus-class models, daily exposure has exceeded $100,000 in documented cases.

Operation Bizarre Bazaar, documented by Pillar Security Research between December 2025 and January 2026, mapped the industrial scale of this economy: approximately 35,000 attack sessions in 40 days, a functioning commercial marketplace called silver.inc reselling access to more than 30 AI providers, and threat actors maintaining accounts across the entire landscape of frontier AI services — not just Claude.

The downstream endpoint of this supply chain is the gray-market transfer station economy operating primarily through Chinese platforms including GitHub, Taobao, and Telegram. An investigation by Oxford China Policy Lab researcher Zilan Qian documented proxy networks selling Claude access at roughly 10 percent of official pricing — sustained through a combination of stolen credentials, account pooling, and harvesting users' prompts and outputs for resale as AI training data. In a separate but related development, Anthropic told the U.S. Senate Banking Committee in June 2026 that operators it alleged were linked to Alibaba's Qwen lab had conducted nearly 28.8 million unauthorized Claude exchanges through roughly 25,000 fraudulent accounts over six weeks — what Anthropic described as the largest known distillation attack against its models. Alibaba denied wrongdoing.

Why Anthropic's Response Only Goes Halfway

Anthropic's email to affected users is unusually candid about the limitation of its own remediation. "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware," the company stated. "If it's still on your computer, your next login session could be stolen the same way."

This means users whose accounts were forcibly logged out are not protected if the malware remains on their device. Logging back into Claude after the forced logout — without first eliminating the infostealer — simply creates a new session cookie for the malware to steal again. The cycle repeats.

Anthropic's detection appears to have worked through behavioral anomaly: the company told affected users that if their "usage limits looked like they refilled and then drained while you weren't using Claude, this was likely the cause." That characteristic pattern — a subscription quota depleted rapidly from a different IP or device — is among the behavioral signals that distinguish legitimate use from session-replay exploitation.

What Anthropic is not able to do is remove the malware from users' computers. The remediation stops at the service boundary. A user who received Anthropic's email has confirmed evidence of infostealer compromise and should treat every credential stored in that browser as potentially exposed — not just Claude, but banking, corporate logins, and any other authenticated session that existed on the device at the time of infection.

One affected user described discovering their compromise through an alert from Anthropic about unauthorized API token consumption on their account, as documented by BleepingComputer. The user had previously downloaded a pirated game, which contained hidden infostealer components — a delivery vector that security researchers consistently identify as among the most common infection paths for this malware class. The user additionally noted that changing passwords and enabling two-factor authentication had done nothing to prevent the session theft, because the attacker held a still-valid session cookie that predated those changes.

What Defensive Technology Exists and Why It Hasn't Fully Arrived

The technical solution to pass-the-cookie attacks exists but is not yet universally deployed. Google made Device Bound Session Credentials (DBSC) generally available in Chrome 146 for Windows users in April 2026, a mechanism that cryptographically links a session cookie to the hardware security chip (TPM) inside the user's computer. A session cookie bound this way cannot be replayed on a different device, because the private key never leaves the originating machine. macOS support using the Secure Enclave was announced for a subsequent Chrome release.

The limitations remain significant. DBSC has no equivalent in Firefox, Safari, or iOS browsers, which have not yet moved beyond an evaluation stage. And it does not protect against an attacker who compromises the same machine that holds the private key — which is the scenario in play when an infostealer is already running locally. DBSC addresses off-device replay, which is the final step of the attack chain, but not same-device compromise, which is where the chain begins.

The structural gap is that browser session management was designed for convenience, not for adversarial environments where an attacker can read the session store directly. Short-lived session tokens, continuous behavioral anomaly monitoring, and hardware-bound session credentials are all known mitigations — but none is universally deployed, and none operates without coverage gaps that a well-designed infostealer can exploit.

The six malware families Anthropic named are not edge cases. They are, or recently were, among the most actively distributed credential-stealing tools in the world. The FBI's attribution of 10 million infections to LummaC2 alone — prior to its 2025 partial disruption — reflects the breadth of the exposure. Every infected device is a potential source of valid session cookies for every AI service its owner has authenticated against.

What Affected Users Need to Do

Anthropic's email advises changing credentials and revoking active sessions, but those steps are insufficient if malware is still running. Security professionals consistently recommend that users who discover a confirmed infostealer infection treat the system as untrustworthy and plan for full remediation: not just removal of the detected malware process, but verification that no persistence mechanisms, backup droppers, or rootkit-level components remain installed.

The practical difficulty is that modern infostealers are specifically designed to evade antivirus detection. Vidar, LummaC2, and Acreed all employ techniques — obfuscated execution, in-memory-only components, self-deletion after credential exfiltration — that allow them to complete their mission and leave minimal forensic traces. A clean antivirus scan does not guarantee a clean system.

In addition to addressing the malware itself, any user who receives Anthropic's notification should revoke all active sessions across all services that were logged in on the affected device at any point during the infection window — including Google, Microsoft, banking services, and any corporate SSO system. The stolen session log that an attacker purchased from an underground marketplace contains a complete snapshot of every authenticated session present in the browser at the time of data exfiltration, not just Claude.

The attack Anthropic confirmed this week is not novel in technique — pass-the-cookie attacks have been the dominant account-takeover method for several years. What has changed is the commercial infrastructure built around stolen AI compute specifically, and the speed at which new malware families emerge to fill gaps left by law enforcement takedowns. The underground economy Anthropic is now contending with has a supply chain, a customer base, pricing tiers, and customer service. Forced logouts interrupt individual sessions; they do not dismantle the infrastructure generating demand for the next set of stolen credentials.