Anthropic addresses infostealer malware affecting Claude AI accounts

Image credit: Search Engine Journal

Anthropic is addressing a wave of infostealer malware incidents that have compromised user accounts on its Claude AI platform by stealing login sessions and payment information globally.

The company initiated proactive measures, including signing out affected users and removing payment methods from accounts identified as compromised, to mitigate further unauthorized access and financial exposure.

Anthropic’s systems detected unauthorized activity on several user accounts, prompting immediate session terminations and the removal of stored payment details, according to a company statement.

Infostealer malware operates by exfiltrating sensitive data such as passwords, login cookies, and session IDs from infected computers, enabling threat actors to bypass traditional authentication methods.

The malware strains identified in these attacks include Vidar, Lumma (LummaC2), StealC, RedLine, and Acreed, primarily targeting Windows operating systems.

For Mac users, Atomic Stealer (AMOS) was among the identified threats, contributing to the account compromises.

One user reported that two-factor authentication failed to protect their account because criminals leveraged stolen session IDs and cookies to bypass the security measure directly.

In an unusual claim, a user stated that Anthropic‘s Claude Opus model on their computer detected, deactivated, identified, and subsequently reverse-engineered the infostealer malware.

The user further detailed that the malware operated on a timed schedule, dispatching batches of stolen login credentials to a remote server every few minutes, effectively bypassing standard antivirus protections like Windows Defender.

Source: Search Engine Journal