Six infostealers replay live Claude session cookies, skip 2FA

Anthropic started emailing affected users on August 30 after malware stole live Claude session cookies and replayed them to log in. Six commodity infostealer families did it: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS, per Help Net Security's writeup. Anthropic invalidated the sessions, stripped saved payment methods, and refunded unauthorized charges.

None of these six are new or exotic. They're rental malware anyone can buy access to. What's different is what they grabbed. A stolen password still has to clear 2FA, SSO, device checks. A session cookie is the state that exists after all of that already said yes, so replaying it walks past every check you set up. Your account page won't show anything wrong, because the server sees you.

The tell people noticed: usage limits that seemed to refill and then drained overnight with nobody at the keyboard. If your Max weekly quota kept vanishing over the past few weeks and you blamed the plan, check again. The attackers weren't reading conversations. They were spending your paid inference.

For anyone running agent workloads on a subscription, that reframes what's at risk. Quota has resale value now, which makes a dev machine a target regardless of what's in its repos. The exposure runs through browser extensions, MCP servers, npm-installed CLIs, and skills pulled off GitHub, since each one can read the same cookie store.

Log out everywhere from account settings to force new sessions. Remove and re-add payment methods rather than trust that the strip caught everything. Run a malware scan. On macOS don't assume the platform protected you, since Atomic Stealer targets browser cookie stores and keychain items directly. I've been sloppier than I should be about what has read access to my browser profile folder. Agent tooling gets broad filesystem grants from me for convenience, and this disclosure is what pushed me to go audit it.