Hackers steal Claude sessions with infostealer malware and burn through victims' usage limits
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
Access to powerful SI has become so valuable that it is stolen like bank passwords, so an SI subscription now deserves the same serious protection.
Anthropic confirmed that attackers are using common infostealers to steal Claude login sessions from users' computers and spend their limits: for some subscribers, usage jumped from 0 to 100% within minutes, and one had their limit drained three days in a row. When it detects this, the company logs the user out, revokes authorizations and refunds the money, but it does not provide a detailed usage breakdown that would help users spot the theft.
Sources 1