{"data":{"id":2287,"lang":"en","title":"Infostealer Malware Is Hijacking Claude Accounts to Drain Paid Usage, Anthropic Warns","summary":"Infostealer malware is stealing Claude login sessions to drain users' paid usage, and Anthropic is signing out affected accounts and refunding unauthorized charges.","category":"ai","category_label":"AI","published_at":"2026-08-31T10:01:31Z","updated_at":"2026-08-31T10:01:31Z","url":"https://techtools.cz/tools/news/article/2287-infostealer-malware-is-hijacking-claude-accounts-to-drain-paid-usage-anthropic","api_url":"https://techtools.cz/news-api/v1/articles/2287?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2287.md?lang=en","image_url":"https://www.bleepstatic.com/content/hl-images/2026/02/13/Claude_chats.jpg","word_count":180,"reading_time_minutes":1,"sources":[{"url":"https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/","domain":"bleepingcomputer.com"},{"url":"https://securityaffairs.com/198166/ai/infostealers-are-hijacking-claude-sessions-and-draining-subscriptions.html","domain":"securityaffairs.com"}],"translation":{"lang":"cs","id":2360,"title":"Infostealer malware unáší účty Claude a vysává předplacené využití, varuje Anthropic","url":"https://techtools.cz/tools/news/clanek/2360-infostealer-malware-unasi-ucty-claude-a-vysava-predplacene-vyuziti-varuje","api_url":"https://techtools.cz/news-api/v1/articles/2360?lang=cs"},"content":"Anthropic disclosed on August 30 that a wave of infostealer malware families — including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS — is stealing users' active Claude login sessions directly from infected computers. Because the malware copies already-authenticated session cookies rather than passwords, it bypasses two-factor authentication and single sign-on entirely, letting attackers replay a victim's session and burn through paid usage without ever entering a password.\n\nAffected users noticed their usage limits refilling and then draining while they weren't using Claude at all — the telltale sign of a hijacked session. Anthropic said it is signing out compromised accounts, removing saved payment methods, and refunding charges it identifies as unauthorized.\n\nThe company stressed the malware isn't distributed through Claude or related to anything users did within the app — infections trace back to sources like pirated software downloads. Because the fix only addresses the account, not the infected device, Anthropic is urging affected users to run anti-malware scans and change their credentials, warning that a freshly issued session could simply be stolen again on the next login."}}