Anthropic Users Hit by Infostealer Attacks, Session Thefts

Threat actors targeted Anthropic's Claude users by deploying infostealer malware to harvest session cookies and credentials, enabling unauthorized account takeovers without needing passwords. This attack highlights a critical gap in user security hygiene — malware on endpoint devices can bypass even strong authentication by stealing active session tokens directly from browsers. Session cookie theft is particularly dangerous because it sidesteps multi-factor authentication entirely once a valid session is captured. Organizations and individuals using AI platforms for sensitive work must recognize that endpoint compromise directly translates to cloud account compromise. The unknown scale of affected users underscores the lack of visibility many platforms and users have into credential theft events.