Anthropic Links Claude Session Theft to Infostealer Malware

Anthropic warned that infostealer malware on a user’s device stole active Claude browser sessions (cookies/credentials), enabling attackers to reuse authenticated sessions without completing sign-in or MFA; the incident reflects endpoint compromise rather than a Claude infrastructure breach. The report highlights risks to other exposed secrets (passwords, API keys, cloud credentials), recommends isolating/cleaning the device, revoking sessions, rotating credentials, and investigating broader exposure, and notes threat-intel and monitoring can help detect related leaks.