In late August Anthropic notified users that attackers had used common infostealer malware to copy Claude session cookies from infected machines and replay them to consume usage on paid accounts without interacting with the login page or two‑factor authentication (2FA). An affected user posted the notification to Reddit and BleepingComputer reported on the incident on August 30.
Stealer families identified Anthropic named several stealer families involved in the campaign: on Windows Vidar, LummaC2, StealC, RedLine and Acreed, and on a small number of Macs Atomic Stealer. The company described these as general-purpose infostealers that copy browser login cookies along with saved passwords.
How cookie replay bypasses SSO and 2FA The attack flow runs from an infected endpoint to a stolen cookie and onward past checkpoints that never fire. Two‑factor authentication protects the login process; after a successful login the site issues a session cookie to the browser. An attacker who copies and replays that cookie appears to the server as the already-authenticated user. Help Net Security characterized session theft as becoming the new credential theft on August 31.
Anthropic's response and remaining unknowns Anthropic signed affected accounts out, removed saved payment methods and refunded charges it identified. The company did not disclose how many accounts were impacted, whether Team or Enterprise seats behind SSO were affected, or whether replayed sessions accessed conversation history or connected apps rather than just usage — VentureBeat's inquiries had not been answered by publication.
Why card-billed, self‑serve accounts matter The mitigation steps (sign out, remove card, refund) point to directly billed, self‑serve accounts authenticated through Anthropic's own login rather than through a corporate identity provider. Those personal subscriptions are not governed by a tenant admin, so no enterprise console can remotely sign them out. Team and self‑serve Enterprise orgs can also be card‑billed, so this is a strong inference rather than a closed conclusion.
Risk to OAuth connectors and data access A replayed session inherits whatever the legitimate session could reach: conversation history, files uploaded to projects, and any connectors the user authorized. Anthropic’s help center explains that connectors let Claude read data and take actions in connected services; read and search operations run without approval, while write actions are approval-gated by default. The exfiltration path through an authorized connector is therefore the part that remains open.
Google Workspace and personal account grants Individual Claude accounts can hold Google Workspace connectors, so a personal Pro subscription can contain a live authorization to a Gmail inbox or Drive folder. If that inbox is a work mailbox, the attacker holding the replayed cookie has a read path that the corporate identity provider evaluated once when the employee clicked allow — and usually not again. A Claude tenant administrator cannot sign that personal account out, and the Workspace or Entra admin who could revoke the underlying grant often does not know it exists.
Parallel delivery vectors One Redditor traced the infection to a pirated game, according to BleepingComputer. Earlier campaigns included a spoofed Claude download page hosted via a public Artifact on the claude.ai domain and promoted by a sponsored Bing ad that sent people searching for a "Claude Desktop app" to the fake installer. Huntress documented a FakeAgent campaign (also called SectopRAT) that compromised employees at 29 organizations in two days and accumulated roughly 7,100 downloads before Anthropic removed the Artifact. A separate fake Claude installer was pushed through a spoofed download site earlier in the year, per Malwarebytes, showing that enterprise employees searching for an official app on work machines are a vector beyond piracy.
LLMjacking and the cost‑harvesting market The problem ties into an active criminal market: Adam Meyers, CrowdStrike’s senior vice president of counter adversary operations, said in an August 6 interview that criminals buy and resell stolen ChatGPT, Claude and Gemini credentials, fed by infostealer malware. CrowdStrike's 2026 Threat Hunting Report documents an LLMjacking campaign that pushed nearly 200,000 API requests through a compromised cloud account’s AI model access in two minutes. Meyers distinguishes stealing credentials (LLMjacking) from cost harvesting, where attackers manipulate victims' AI resources to generate massive bills — a sort of "LLM coin mining."
Enterprise controls and example mitigations Some vendors have taken different design decisions to avoid this exposure. Tom Kleinpeter, co‑founder and chief architect at Common Room, said they rejected local MCP servers early because storing long‑lived API keys or tokens on a user’s machine allows indefinite impersonation if stolen. Common Room shipped its first agent integration in October 2025 using Okta Auth0 for authentication, separate read and write scopes, and writes off by default.
Okta Agent SSO Okta made Agent SSO generally available on August 24, 2025, registering AI agents as first‑class identities in Universal Directory and issuing short‑lived, identity‑governed tokens instead of stored credentials. The announcement cites Claude as an example of an agent that security teams can now govern natively. Six days later Anthropic was signing users out after stealer families had copied Claude cookies — the agents received governed identities while people using Claude on personal cards did not.
Recommended actions for security teams
- Add AI accounts to the infostealer response playbook. If an endpoint alert names a stealer family, treat every AI service session on that machine as compromised, revoke what you can from the enterprise tenant, and have employees sign out of personal accounts until the device is cleaned.
- Warn users that the notification e‑mail itself can be a phishing template; Help Net Security has flagged copycat phishing using this campaign as pretext.
- Inventory personal subscriptions on managed devices using browser telemetry, CASB logs and expense reports to surface sessions and payments.
- Prevent personal AI accounts from holding OAuth grants into corporate Google Workspace or Microsoft 365; both platforms allow administrators to restrict third‑party app authorization so a work inbox can only be attached from a tenant the security team can revoke.
- Revoke OAuth grants that Claude already holds, not just the Claude session. Signing out invalidates the stolen session but does not revoke Google or Microsoft consents left behind.
- Move heavy users onto organization‑managed tenants where an owner controls connector enablement.
- Put session binding on the renewal agenda: Google shipped Device Bound Session Credentials in Chrome 146 on Windows in April and enabled it by default for Google accounts and Workspace Individual accounts in May, binding sessions to a TPM‑backed private key so copied cookies cannot be refreshed elsewhere; currently this covers Chrome on Windows only, leaving Mac victims outside that protection.
Conclusion Anthropic’s notifications highlight that session‑cookie replay can completely bypass SSO and 2FA protections and that self‑served, card‑billed AI accounts can carry OAuth grants into corporate resources. While signing users out and refunding charges addresses immediate financial misuse, it does not automatically remove connector grants or other persistent access. Effective defense requires endpoint protection, governance of OAuth authorizations, consolidation of sensitive users onto managed tenants and adoption of session binding and short‑lived, identity‑governed credentials.
