Anthropic’s Claude AI platform is under active assault from cybercriminals using infostealer malware to silently take over user sessions. Two different attack chains have been confirmed, both focused on stealing authenticated session data like browser cookies, rather than passwords — allowing attackers to bypass two-factor authentication (2FA) and single sign-on (SSO) safeguards. Malicious activity has included draining paid account resources and retaining access even after account holders change passwords or clean their devices.
What’s Happening: Session Hijacking, Fake Installers, Poisoned Files
On Windows, malware families such as Vidar, Lumma (also known as LummaC2), StealC, RedLine, and Acreed are harvesting saved passwords, session cookies, and locally stored credentials. macOS is also affected, with Atomic Stealer performing similar data-siphoning. The stolen data allows attackers to “replay” active Claude sessions. This approach makes countermeasures like 2FA and SSO ineffective, since the attacker uses already-authenticated tokens rather than re-entering login credentials. Anthropic first noticed the issue when users saw usage limits refilled and then drained, often while they weren’t even active.
A second threat vector dubbed FakeAgent is orchestrated via malicious advertisements: users searching for the “Claude desktop app” were shown paid ads pointing to a malicious installer hosted on claude.ai. The installer—impersonated by a file called ClaudeDesktop.exe—used DLL sideloading through a tampered libcef.dll and a helper binary from JetBrains to deploy SectopRAT, a remote access trojan. This malware harvests browser credentials, credit cards, cookies, and other files. Security company Huntress confirmed this fake installer compromised at least 29 organizations in two days, racking up about 7,100 downloads before being taken down.
Attackers have also begun poisoning SKILL.md files—configuration-like files used for Claude’s agent skills—by embedding malicious instructions disguised as style guide notes. When these innocent-seeming files are loaded, they silently re-download the infostealers, allowing them to persist even after an OS reinstall if the tainted file is reintroduced. Instances include a Web3 founder who nearly lost control of crypto wallets after executing a terminal command suggested by Claude.
How Anthropic Responded & What Users Should Do
To mitigate the fallout, Anthropic is signing out accounts that were accessed without authorization, removing stored payment methods to prevent unauthorized charges, and refunding confirmed fraudulent activity. But these steps alone don’t cleanse infected devices of malware. If a threat still resides on the machine, any newly created sessions could be harvested again.
Security experts recommend scanning systems for malware before logging back into Claude, resetting associated email account passwords, enabling 2FA, and updating any credentials saved in browsers. Users should treat AI-suggested links or terminal commands with the same wariness as email attachments. Organizations making heavier use of Claude are advised to sandbox agent environments and audit SKILL.md or similar configuration files for hidden instructions.
Without vigilance, the malware can reestablish access even after cleanup efforts—especially via poisoned configuration files. For those who rely heavily on Claude, this is a wake-up call to tighten security practices around session management, credential storage, and trusted file integrity.
