Anthropic Locks Out Claude Users After Infostealers Hijacked Login Sessions
Anthropic has begun logging Claude users out of their accounts and stripping saved payment methods after infostealer malware on their own PCs and Macs let attackers replay stolen login sessions. The company says the malware is general-purpose, not tied to Claude.
Anthropic has started signing Claude users out of their accounts and removing their saved payment methods, not because Claude was breached, but because infostealer malware on the users' own computers let attackers ride their existing login sessions into the accounts. The company disclosed the campaign in emails to affected customers on August 31, 2026, and said it also refunded charges it identified as unauthorized.
The tell for many victims was a billing pattern rather than a login alert: usage limits that appeared to refill and then drain while the user was not touching Claude. SecurityWeek reported that Anthropic detected the activity, signed out the compromised sessions, and pulled saved cards as a precaution, telling users they must add a payment method again to renew or make further purchases. Help Net Security reported the same lockout-and-refund response, framed around a blunter point: the login itself was never the weak link.
What Anthropic Actually Did
Anthropic took three concrete actions on affected accounts. It invalidated the stolen sessions by forcing a sign-out, it removed the saved payment method so the account could not be charged, and it refunded Claude charges it flagged as unauthorized. The company also warned it may sign users out again if it observes further signs of account misuse.
What the lockout does not do is clean the machine, and Anthropic said as much. "Signing you out of Claude stops the stolen sessions, but it doesn't remove the malware," the company wrote in the emails to affected users, per Help Net Security. If the infostealer is still resident, the next session a victim creates can be lifted the same way the first one was. That is why the payment-data removal is paired with a specific instruction: only re-add a card after the endpoint has been cleaned.
Anthropic also drew a boundary around blame. Help Net Security reported the company told users it has "no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude," and that phones and tablets do not appear to have been involved. One affected user who posted the suspension email to Reddit traced their own infection to a pirated game downloaded from an underground forum.
The Named Malware Families
The infections in this campaign trace to a familiar roster of commodity infostealers, not to anything bespoke. Anthropic named Vidar, Lumma (also tracked as LummaC2), StealC, RedLine, and Acreed on Windows, plus Atomic Stealer (AMOS) on a small number of Macs. In its email, per Help Net Security, the company described it as "general-purpose malware that typically arrives with an unofficial download or a malicious app, and it quietly copies saved passwords, login cookies in browsers, and credentials for other apps running locally."
The distinction matters for how defenders should read this. These families steal whatever is on the disk: browser cookies, saved passwords, application tokens. A Claude session was one item in a much larger harvest, and Anthropic's read is that a threat actor later sifted the stolen Claude sessions out of that broader loot and monetized them by running up paid usage. The AI account was collateral, then it became the product.
CyberSignal readers have seen the delivery side of this before. The "unofficial download" vector is the same trust surface abused by fake Claude installers and AI-chatbot SEO lures, and Atomic Stealer is the same macOS family recently pushed through a fake Cloudflare check on a compromised storefront. The malware is old news. The victim being an AI subscription, with a metered balance an attacker can drain for cash, is the newer wrinkle.
Why a Stolen Session Beats Your 2FA
Session theft sidesteps two-factor authentication entirely, and understanding why is the whole point of this story. Two-factor protects the moment of login. Once you are in, the site hands your browser a session cookie so you do not have to re-authenticate on every click. An infostealer copies that cookie, and an attacker who replays it is treated as an already-logged-in user. No password prompt, no one-time code, no push notification, because from the server's point of view the session was already established.
That is what makes forced sign-out the correct first move for a vendor: invalidating the session is the only thing that immediately breaks a replayed cookie. It is also why this belongs in the same conversation as account takeover generally. The credential was never phished or cracked here. The already-authenticated state was stolen, which is a harder problem for any MFA scheme to catch on its own.
What Claude Users Should Do Now
If you got the email, the order of operations is not optional. Cleaning the machine has to come first, because every other step is undone by a live infection. The sequence below follows Anthropic's own guidance as reported by both outlets.
● Claude Account Recovery If Anthropic locked your account, work top to bottom. The order matters. |
Step 1 · Scan and Clean First Run a full antivirus or EDR scan and remove the malware before anything else. A forced sign-out stops the stolen session but does not remove the infection, and a still-infected device gives up your next session the same way. |
Step 2 · Rotate Credentials Set a new password and turn on MFA (2FA) for the email you use with Claude. Update any passwords saved in your browser, and check card statements if you stored payment details there. |
Step 3 · Revoke Other Sessions Sign out of your other online services and log back in, so any session cookies stolen alongside Claude stop working too. |
Step 4 · Re-Add Payment Last Only re-add a payment method after the endpoint is confirmed clean. Anthropic removed saved cards on purpose, and restoring billing on an infected machine re-arms the same loop. |
Recovery steps per Anthropic’s customer email, as reported by Help Net Security and SecurityWeek, Aug 31 2026. |
The single most common mistake here is re-adding a payment method too early. Anthropic removed the card on purpose. Putting it back on a machine that still has RedLine or AMOS running just re-arms the same loop. Confirm a clean scan first, then rotate credentials, then restore billing.
What Is Not Confirmed
Several details that readers will reasonably want are not in the disclosure, and it is worth being precise about the gaps. Neither outlet reported a number of affected accounts, beyond Anthropic's note that Atomic Stealer hit "a small number" of Macs. No named victim organizations have been disclosed. There is no indication in the reporting of whether peer AI vendors (OpenAI, Google, xAI) are running parallel lockouts, so this reads as an Anthropic-specific response rather than an industry-wide one. And the specific distribution channels for the malware are described only in general terms (unofficial downloads, malicious apps, one self-reported pirated game), not enumerated. Treat all four as open questions, not established facts.
One practical warning does follow from the disclosure: because affected users are publicly sharing screenshots of the real suspension email, expect copycat phishing that impersonates Anthropic and uses this campaign as a pretext. Verify any "account locked" message against the account directly, not through a link in the email.
My Read
My read: this is assessment, not reported fact. AI accounts have crossed a threshold: a metered, billable balance tied to a replayable session is now a line item in stealer-log marketplaces, worth pulling out of the general loot and cashing out. The genuinely new thing is not the malware, it is the vendor posture. Proactively logging paying customers out and yanking their stored cards, before most of them noticed anything, is an aggressive containment stance that trades user friction for a hard stop on abuse. Whether that becomes the norm across AI vendors, or stays an Anthropic quirk, is the pattern worth watching. Either way, the endpoint is still the battlefield, and the account is just where the loss shows up.
