Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
62
Malware
RedLine
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 31, 2026
- Last mentionedSep 28, 2026
Timeline
3 articles · newest firstInfostealers Are Hijacking Claude Sessions and Draining Subscriptions
Infostealers hijacked active Claude sessions to bypass 2FA, drain paid usage and run unauthorized charges; Anthropic is revoking sessions and refunding.
68
Anthropic locks out Claude users after infostealers hijack login sessions
Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.
70
Appears with
- Vidarmalware · 3
- Acreedmalware · 2
- Lummamalware · 2
- Claudeproduct · 2
- Anthropicorganization · 2
- Atomic Stealermalware · 2
- StealCmalware · 2
- Anthropicvendor · 2
- GitLabproduct · 1
- Miasmamalware · 1
- Verizonorganization · 1
- LummaC2malware · 1
- Wizorganization · 1
- Anthropic usersvictim · 1
- JINX-0164threat actor · 1
- Microsoftvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.