Hackers are stealing Claude tokens from subscribers
Infostealer malware is stealing Claude login sessions, letting attackers mint OAuth tokens and burn subscribers' paid usage largely undetected.
Anthropic confirmed a bad actor used common infostealer malware to steal Claude login sessions from users' computers and consume their paid usage. A UK consultant saw idle token usage climb, and Anthropic suspended his account, invalidated sessions and Claude Code tokens, and issued a £44.49 partial refund on his $200-per-month plan. Multiple other users on Reddit and GitHub reported similar theft; Anthropic signed out affected users and issued refunds, but still lacks itemized usage reporting to help users detect misuse.
- Compromised Claude session keys were used to mint unauthorized Claude Code OAuth tokens.
- Anthropic lacked itemized usage tracking, so theft could persist for months undetected.
- Infostealer malware harvested Claude login sessions from infected computers, not via Claude itself.
- Anthropic invalidated sessions, issued refunds, and warned affected users of malware.
- At least one affected consultant canceled Claude for Cursor after poor support.
- ATT&CK
- T1539 Steal Web Session CookieT1528 Steal Application Access TokenT1555.003 Credentials from Web Browsers
- Products
- ClaudeClaude CodeCursor
- Malware
- infostealer
- Organizations
- Anthropic
- Countries
- United Kingdom
- AI models
- Claude
From the original article
3 min read at techcrunch.com
Last month, a Claude user noticed his account was consuming tokens even though he wasn't working. Anthropic has since warned users about hackers.
By Julie Bort · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.