Info-stealing malware hijacks Claude sessions; Anthropic forces logout and issues refunds

Anthropic has confirmed that multiple information-stealing malware families can hijack already logged-in Claude sessions, bypass passwords, MFA, and SSO, and consume paid credits. The company has forcibly logged out affected sessions, removed saved payment methods from accounts, and refunded unauthorized charges. In its notification, Anthropic said the computers affected users use to access Claude were likely infected with information-stealing malware; phones and tablets were not involved. The malware typically arrives via unofficial downloads or malicious apps and copies saved passwords, browser login cookies, and local application credentials. The company identified Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, as well as Atomic Stealer on a small number of Macs, and noted that revoking sessions or blocking fraudulent payments alone is not enough—while the device remains infected, the malware can capture the next login. Existing plans continue until the end of the current billing cycle, after which users must re-add a payment method. Anthropic recommends running a full malware scan before logging back in and changing passwords with two-factor verification enabled.