Anthropic locks out Claude users after infostealers hijack login sessions
Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.
Anthropic began locking users out of Claude accounts after infostealer malware stole browser session cookies, letting attackers replay logins and bypass two-factor authentication. Identified malware includes Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Anthropic signed affected users out, removed saved payment methods and refunded unauthorized charges. One affected user traced the infection to a pirated game downloaded from a Russian underground forum; the company advised victims to remove the malware before resetting passwords and re-enabling 2FA.
- Malware named: Vidar, Lumma, StealC, RedLine, Acreed on Windows; AMOS on macOS
- Session cookie replay sidesteps 2FA by reusing already-authenticated logins
- Anthropic signed users out, removed saved payment methods and refunded unauthorized charges
- One user traced infection to a pirated game from a Russian underground forum
- Users warned of copycat phishing emails impersonating Anthropic
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | claude.ai | so: How attackers hosted a fake Claude download page on the claude.ai domain Subscribe to our breaking news e-mail alert to never |
From the original article
2 min read at helpnetsecurity.com
Anthropic has started locking users out of their Claude accounts due to their login sessions having been compromised through infostealer malware. “The malware identified in this campaign so far include Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, and Atomic Stealer (AMOS) on a small number of Macs,” the company said in emails sent out to affected users last week.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.