Cybercriminals are using infostealer malware to hijack Claude AI sessions, bypassing 2FA to drain usage credits. Learn how these attacks work and how to stay safe.

The rapid adoption of generative AI by businesses has created a new, lucrative target for cybercriminals. Anthropic, the developer of the Claude AI platform, has issued warnings that bad actors are employing infostealer malware to hijack user accounts. Unlike traditional hacking attempts that rely on guessing passwords, these attacks target the very mechanism that keeps a user logged in, effectively rendering many standard security measures obsolete.

The mechanics of session hijacking

The current wave of attacks does not target the Claude platform itself, but rather the end-user's device. Infostealer malware—including families such as Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS—is designed to operate stealthily. These programs scan a compromised computer for saved passwords, browser cookies, and locally stored credentials.

The primary goal in this scenario is the theft of authenticated session cookies. When a user logs into Anthropic, the browser stores a cookie that proves the user has already been authenticated. By stealing this cookie, an attacker can replay the session on their own machine. Because the system believes the user is already logged in, the attacker bypasses two-factor authentication (2FA) and single sign-on (SSO) entirely. This allows unauthorized access to the account without the criminal ever needing the user's actual password.

Draining credits and financial impact

The immediate motive for these hijackings appears to be the theft of computational resources. Anthropic noticed a pattern where usage limits were being refilled and then rapidly drained while the legitimate account owners were inactive. For professional users, the financial implications can extend beyond the monthly subscription fee.

Paid Claude plans often include usage credits that allow users to continue operating via consumption-based billing at standard API rates once their base limit is reached. If a victim has enabled auto-reload—a feature that automatically purchases more prepaid credits when the balance hits a certain threshold—attackers can trigger significant unauthorized charges. To mitigate this, Anthropic has begun signing out compromised sessions and removing saved payment methods from affected accounts to block further financial drain.

We recently signed you out of Claude and removed the payment method saved on your account, so you’ll need to log back in and re-add your card.

The FakeAgent campaign and infrastructure weaponization

While session theft is a passive attack, a more aggressive campaign tracked by the security firm Huntress, dubbed FakeAgent, demonstrates how attackers can weaponize the AI's own ecosystem. Between July 21 and July 22, 2026, attackers used sponsored Bing ads to lure users searching for the Claude desktop app. These ads directed victims to a malicious public Claude Artifact hosted directly on the legitimate claude.ai domain.

Because the malicious page resided on a trusted domain, it inherited the official SSL certificate and search authority, making it nearly indistinguishable from a legitimate source. Users who downloaded the fake installer, disguised as ClaudeDesktop.exe, were infected with SectopRAT, a .NET remote access trojan. This malware harvests credit card data, files, and browser credentials. Huntress reported that at least 29 organizations were compromised in just two days, with approximately 7,100 downloads occurring before the page was removed.

Persistence through poisoned configuration files

Cybercriminals are also exploring ways to maintain access to systems even after an initial cleanup. A new technique involves the use of poisoned SKILL.md files. These are documentation-style configuration files used by Claude’s agent skills. Attackers disguise malicious instructions as standard style-guide notes within these files.

When Claude loads the poisoned file, hidden commands are triggered to silently re-download the infostealer malware and harvest fresh credentials. This creates a cycle of reinfection that can be difficult for the average user to detect, as the malicious activity is embedded within the AI's own operational framework.

The broader risk of AI-powered crime

Beyond the immediate cost of drained credits, the hijacking of professional AI accounts poses a systemic risk. Stolen Claude capacity can be used by criminals to scale their own operations. By leveraging a high-capacity AI, attackers can refine phishing content, build complex campaign infrastructure, and obfuscate malware code more efficiently.

According to reports from BleepingComputer, these hijacked accounts provide a "clean" environment for criminals to analyze stolen information or improve delivery methods for other scams, all while using the victim's paid resources and reputation.

Global business implications and regulatory outlook

For entrepreneurs and enterprises in the USA, UK, and global markets, this incident highlights a critical gap in the AI security stack. The fact that 2FA is bypassed via session theft means that traditional identity management is no longer a sufficient defense against infostealers.

In the United States and the United Kingdom, where corporate reliance on AI for proprietary data analysis is surging, the risk of "shadow AI" usage—employees using personal accounts for work—increases the attack surface. If an employee's personal device is compromised, the corporate data they feed into Claude could be exposed to the attacker who hijacks the session.

From a regulatory perspective, while the EU AI Act focuses heavily on the safety and ethics of the models themselves, this breach emphasizes the need for rigorous cybersecurity standards for the deployment of AI. Businesses should move toward hardware-based security keys and strict endpoint detection and response (EDR) tools to catch infostealers before they can exfiltrate cookies. For those operating in the UK and US, auditing the use of auto-reload features on AI accounts is now a necessary financial control to prevent unexpected billing spikes caused by session hijacking.

FAQ

---

Sources: Searchenginejournal, Cybersecuritynews, Bleepingcomputer ·