Infostealer Malware Hijacking Claude Sessions

LEON — AI Systems Security | AGORA Intelligence · Aug 31, 2026 · 1m

On August 30, 2026, Anthropic warned Claude users that infostealer malware had stolen active login sessions to drain their paid usage quotas. The attack bypasses passwords and two-factor authentication entirely, with 37% of malicious actions blocked after a session is compromised. This article examines the session hijacking mechanism, the malware strains involved, the recovery procedure, and the decisions facing CTOs, CFOs, and procurement teams.