Infostealers are bypassing MFA and SSO by stealing Claude session cookies, granting unauthorized access to paid accounts and corporate Google Workspace data.

The security perimeter of the modern enterprise is shifting. For years, the industry has relied on Multi-Factor Authentication (MFA) and Single Sign-On (SSO) as the gold standard for preventing unauthorized access. However, a recent campaign targeting Anthropic's Claude users demonstrates a critical vulnerability: session-cookie replay. By stealing the digital token that proves a user has already logged in, attackers are effectively walking through the front door without needing a key or a second factor of authentication.

The mechanics of the session heist

To understand how these breaches occur, one must distinguish between credentials and sessions. A password is a credential used to gain entry; a session cookie is the digital ID badge issued by the server after the password and MFA have been verified. This cookie allows the user to navigate the platform without re-authenticating every few seconds. Session hijacking occurs when an attacker captures this token and presents it to the server, which then recognizes the attacker as the legitimate, already-authenticated user.

In the case of Claude, attackers utilized common infostealer malware to lift these cookies directly from the users' browsers. Because the cookie represents a state of already-verified identity, the attack chain bypasses the login page entirely. The checkpoints designed to stop intruders—such as 2FA prompts—never fire because the server believes the session is still active and valid.

Malware families driving the campaign

The breach was not the result of a flaw in Anthropic's core infrastructure, but rather the proliferation of general-purpose malware on end-user devices. Anthropic identified six specific stealer families responsible for the campaign. On Windows systems, the primary culprits were Vidar, LummaC2, StealC, RedLine, and Acreed. Mac users were targeted by a smaller number of infections via Atomic Stealer.

These tools are designed to scrape browser data, including saved passwords and active session cookies. In one documented instance, a user traced their infection back to the installation of a pirated game, highlighting a persistent human vulnerability: the tendency to bypass security warnings for the sake of free software. Once the malware is executed, the session cookies are exfiltrated to the attacker, who can then replay them on their own machine to gain instant access to the victim's Claude account.

The danger of self-serve corporate accounts

A critical detail in this security failure is the type of accounts targeted. The affected users were primarily using card-billed, self-serve accounts. These accounts exist in a dangerous middle ground: they are used for professional work, yet they are not governed by a corporate identity provider (IdP). Because they are not integrated into an enterprise SSO framework, there is no central admin console where an IT manager can see active sessions or force a global sign-out.

While SSO is often touted as a prevention tool, in this scenario, its primary value is visibility and revocation. For the self-serve user, there was no corporate oversight to detect the anomaly. The theft was only spotted by Anthropic through the usage meter, as account limits were being refilled and drained rapidly while the legitimate owners were inactive.

From AI chat to corporate Gmail access

The risk extends far beyond the loss of AI compute credits. The most alarming aspect of these stolen sessions is the potential for lateral movement. Many Claude users have granted the AI connector permissions to access other services, such as Google Workspace, to facilitate data analysis and productivity.

The attack chain runs in one direction, from an infected machine through a stolen cookie past a checkpoint that never fires, and into everything the account can reach.

Because the stolen cookie grants the attacker the full identity of the user within the Claude environment, any third-party grants—including access to corporate Gmail—become accessible. This transforms a simple account takeover into a potential corporate data breach, allowing attackers to reach sensitive emails and documents through the AI's integrated permissions, all while bypassing the corporate security stack.

Anthropic's response and remediation

Upon detecting the campaign, Anthropic took several steps to mitigate the damage. The company sent notification emails to affected users and took the following actions to secure the accounts:

• Forced a sign-out of all active sessions, which effectively kills the replayed cookies.
• Stripped saved payment methods to prevent further unauthorized billing.
• Issued refunds for charges incurred during the hijacked sessions.

While the financial loss from burned usage was relatively small, the primary concern remains the data exposure. As noted in reports by VentureBeat, the ability of an attacker to pivot from an AI session into a corporate email environment represents a significant escalation in the risk profile of AI tool adoption.

Global implications for US and UK enterprises

For businesses in the USA, UK, and other global markets, this incident serves as a warning against the 'shadow AI' phenomenon—where employees use personal, self-serve AI accounts for corporate work. From a regulatory and risk management perspective, this creates a blind spot that traditional security audits often miss.

In the US and UK, where data privacy and corporate espionage are high-priority concerns, the lack of IdP governance for AI tools can lead to severe compliance failures. If an employee uses a self-serve Claude account to process sensitive client data and that account is hijacked via a session cookie, the company may still be legally responsible for the data breach, despite the account not being 'official' company software. The inability of IT admins to revoke these sessions means the window of exposure remains open until the user or the provider manually intervenes.

To counter this, enterprises must move toward mandatory SSO integration for all AI tools and implement phishing-resistant MFA. Relying on standard 2FA is no longer sufficient when the session token itself becomes the target. Companies should audit the 'grants' and permissions given to AI connectors, ensuring that the principle of least privilege is applied to prevent a hijacked AI session from becoming a gateway to the entire corporate email archive.

FAQ

---

Sources: Venturebeat, Aventure, Cybersierra ·