30
42
30
30
55
55
55
Infostealers are hijacking Claude accounts at users’ expense
Malwarebytes reports infostealers are stealing Claude session cookies to hijack Anthropic accounts and consume victims' usage at their expense.
Anthropic warned that infostealer malware operators are harvesting Claude session cookies from infected machines. Attackers replay the stolen cookies to take over users' accounts and consume their usage quotas, affecting the victims' own access. The activity involves observed account hijacking rather than a flaw in Claude itself.
55
42
30
Anthropic Users Hit by Infostealer Attacks, Session Thefts
A threat actor used multiple infostealers to harvest session data and hijack Claude accounts belonging to an unknown number of users.
Dark Reading reports that a threat actor deployed a variety of infostealer families to collect session information, which was then used to access Claude accounts belonging to an unknown number of users. Anthropic has not disclosed the scale of the compromise. The incident underscores session token theft via infostealer logs as an effective route into AI platform accounts.
55
30
KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens
Elastic Security Labs details KREMLIN, Brazilian banking malware using malicious Chrome/Edge extensions and Ethereum smart contracts to steal credentials and session tokens.
Elastic Security Labs documents KREMLIN (tracked as REF9334), a Brazilian banking malware toolkit active since at least May 2025 that impersonates a dozen Brazilian banks. It uses multi-stage JavaScript loaders, a C++ installer that DLL-sideloads via a legitimate SentinelOne binary, and a malicious Chrome/Edge extension named 'AVSync System Inc.' Ethereum smart contracts act as dead-drop resolvers for C2 endpoints, a shift that occurred May 19, 2026, making infrastructure hard to disrupt. The extension harvests cookies, sessionStorage/localStorage, browsing history, screenshots, and full page HTML via WebSocket plus CSS-disguised polling endpoints. The group has run seven distinct campaigns and also distributes Pulsar RAT and Remcos RAT.
65
47
30
42
30
42
30
30
60
42
42
60
55
42
42
57
30
30
60
42
30
30
30
30
55
42
30
30