Cybercriminals are targeting users of Anthropic’s Claude platform through multiple attack paths, combining commodity information-stealing malware with deceptive downloads and persistent configuration files. The resulting theft can give an attacker an already authenticated browser session, allowing unauthorized use of paid accounts even when the victim has enabled multifactor authentication or single sign-on.

Anthropic has responded by signing affected accounts out, removing stored payment methods and refunding confirmed fraudulent charges. Those account-level measures contain immediate abuse, but they do not clean an infected computer. If a victim signs in again before eliminating the malware, a fresh session token or newly entered credentials may simply be stolen again.

Why a stolen session can defeat login defenses

Information stealers are designed to collect valuable data already stored on a device. Reported Windows families associated with the campaign include Vidar, Lumma, StealC, RedLine and Acreed, while Atomic Stealer targets macOS. These tools can copy saved passwords, browser cookies and other local credentials, then transmit the collection to an operator.

A session cookie is especially valuable because it represents a login that has already passed authentication checks. By replaying that token, an attacker may enter the victim’s account without submitting the password or completing a second-factor challenge. Investigators noticed suspicious patterns in which usage allowances were replenished and then consumed while legitimate account owners were inactive, indicating that compromised sessions were being exploited for paid access.

Malicious advertising turned a trusted domain into a lure

A related operation tracked as FakeAgent used sponsored search results aimed at people looking for the Claude desktop application. The advertisements led to a malicious public Claude Artifact hosted under the legitimate claude.ai domain. That location gave the page the appearance and encryption certificate of a trusted service, making superficial checks less likely to expose the trap.

The supposed installer, presented as ClaudeDesktop.exe, used DLL sideloading. A modified library was loaded alongside a repurposed JetBrains helper program, leading to deployment of SectopRAT, a .NET remote-access trojan. Once running, the malware could collect browser credentials, payment-card information, cookies and files. Security firm Huntress linked the short-lived campaign to at least 29 compromised organizations and roughly 7,100 downloads before the malicious content was removed.

Configuration files create a route back in

Researchers also highlighted poisoned SKILL.md files, which can hold instructions used by AI-agent skills. Attackers can disguise hostile directions as ordinary documentation or style guidance. When an agent processes the file, embedded commands may retrieve an infostealer and collect credentials without presenting the behavior as an obvious installer.

This technique creates an unusual persistence problem. Reinstalling an operating system may remove the immediate infection, but restoring the same untrusted project or configuration file can trigger reinfection. It also illustrates a broader risk for agentic tools: text and configuration entering an automated workflow can become executable influence, so teams must review instructions with the same care they apply to scripts.

What affected users and organizations should do

Anyone who sees unexplained Claude usage, unexpected charges or unfamiliar sessions should avoid immediately logging back in from the suspected device. The priority is to isolate and scan the system, preserve relevant evidence where organizational incident-response rules require it, and remove the infection. Only then should the user reset the email-account password, rotate credentials stored in browsers and establish a new Claude session.

• Run a complete malware scan before authenticating again.
• Reset the connected email password and verify multifactor authentication settings.
• Rotate browser-saved credentials that the infostealer may have accessed.
• Review billing, active sessions and usage history for unauthorized activity.
• Audit AI-agent configuration files and sandbox workflows that can launch commands.

Users should treat AI-generated terminal commands and links as untrusted until they understand the effect. Organizations deploying agents at scale should restrict execution privileges, control which configuration files may be loaded and monitor unusual network or process activity. The central lesson is that strong authentication cannot protect a session after the endpoint itself has surrendered the token; device hygiene and careful control of agent inputs remain essential.