Session Hijacking Malware: 5 Warning Signs Your AI Account Has Been Hijacked

Some Claude users opened their email this week to a message they never expected: Anthropic had signed them out, removed their saved payment method, and refunded charges they never made. Nothing about their password had leaked. They had not clicked a phishing link inside Claude, and Anthropic was clear that nothing about the malware was related to Claude itself. The cause was session hijacking malware already sitting on their computer, quietly stealing login sessions for whatever it could find, Claude included.

What Just Happened: Anthropic Signs Out Compromised Accounts

In late August 2026, Anthropic began emailing affected Claude users to explain that a bad actor had been using common infostealer malware to lift active Claude login sessions directly off people’s computers. Once stolen, those sessions let the attacker access the victim’s account and burn through their usage limits, sometimes right after the account had just refreshed for the month. Anthropic responded by signing affected users out, stripping saved payment methods from those accounts, and refunding any charges it identified as unauthorized.

The malware families involved, including Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, plus Atomic Stealer on Mac, are not new and were not built to target Claude specifically. Anthropic said plainly that it has no reason to believe the malware came from Claude, was installed through Claude, or had anything to do with what the user did inside the app. The Claude session was simply one more thing already sitting on an infected computer, and someone eventually got around to using it.

What Is Session Hijacking Malware, in Plain English?

Most people picture a hack as someone guessing or stealing a password. Session hijacking malware skips that step entirely. When you log into a website, the site hands your browser a small piece of data called a session token, essentially proof that you’ve already signed in, so you don’t have to re-enter your password on every click. Infostealer malware searches an infected computer for exactly that kind of data: saved passwords, browser cookies, and active session tokens for whatever accounts happen to be logged in at the time.

Once an attacker has that session token, they can often load it into their own browser and be treated as you, fully logged in, without ever knowing your password and without triggering two-factor authentication, since as far as the website can tell, you never logged out in the first place. That’s what makes this style of attack more dangerous than ordinary credential theft: your strongest password and your 2FA app don’t help once the session itself has already been copied.

This Isn’t Just a Claude Problem

Claude is making headlines here mainly because Anthropic chose to notify affected users directly and transparently. The underlying malware doesn’t care what website it finds a session for. The same infostealer families sweep up sessions for email, banking portals, cloud storage, social media, and any other SaaS tool you happen to be logged into when the infection lands. If your computer is compromised, every account you use in that browser is potentially exposed, not just the AI tools.

That’s worth sitting with for a moment if you run a small business. An employee’s infected laptop doesn’t just risk their personal accounts. It risks whatever business tools, shared drives, and paid subscriptions they happen to stay logged into all day. If you’ve read our breakdown of how AI voice cloning scams exploit trust rather than technical access, this is the other side of the same coin: an attack that doesn’t need to fool anyone, just needs an already-infected machine.

5 Warning Signs Your Account Has Been Hijacked

1. Usage or credits drop when you haven’t been using the service. Anthropic specifically flagged this pattern: a plan refills, then quietly drains without the account owner doing anything. The same applies to any tool with usage-based limits or credits.
2. You get logged out for no clear reason. Some services will automatically sign out an account once they detect suspicious activity. An unexpected logout, especially paired with a request to re-enter payment details, is worth investigating rather than dismissing as a glitch.
3. A saved payment method disappears or changes. If a service removes your card on file without you touching your account settings, treat that as a signal something happened on their end, not a random bug.
4. You see login activity from an unfamiliar location or device. Most major services log this somewhere in account settings. A login you don’t recognize is one of the clearest signs a session or credential was used by someone other than you.
5. You receive a security email you weren’t expecting. Take these seriously even if nothing feels wrong on your end. The whole point of session hijacking is that everything looks normal from inside your own browser while it’s happening.

How to Protect Yourself Starting Today

Infostealer malware overwhelmingly arrives through the same handful of doors. Closing those doors matters more than any single account setting.

• Avoid cracked software, pirated media, and game cheats. This remains the single most common way infostealers spread. A free download that seems too convenient for something normally paid is a common trap.
• Be cautious with browser extensions. Only install extensions you actually need, from developers you recognize, and periodically review what’s installed and remove anything you don’t use.
• Use a dedicated password manager instead of saving passwords in the browser. Browser-stored credentials are exactly what infostealers are built to search for first.
• Run a reputable antivirus or anti-malware scan regularly, not just when something already feels wrong.
• Check the active sessions or devices list on your important accounts every so often. Most email providers, banks, and major SaaS tools let you see and revoke sessions you don’t recognize.

What to Do If You Think You’ve Been Hit

• Run a full malware scan first. Changing passwords on an infected machine just hands the new password to the same malware.
• Revoke active sessions on any account you suspect was affected, not just the one that emailed you, since infostealers rarely take just one.
• Change your passwords from a clean device once the infection is actually removed.
• Check for unauthorized charges across your accounts and dispute anything that isn’t yours.
• Enable two-factor authentication everywhere it’s offered. It won’t stop an already-stolen session, but it raises the bar considerably for future password-based attempts.

For the full technical detail on this specific incident, BleepingComputer’s original report on the Claude session hijacking is the most complete primary source.

Final Thoughts on Session hijacking malware

Session hijacking malware doesn’t need to guess your password, and it doesn’t care which AI tool, bank, or SaaS product you happen to have open. It just needs one infected download to quietly collect whatever you’re logged into. The Claude incident is a useful wake-up call precisely because Anthropic was transparent about it, but the actual lesson has nothing to do with which AI company you use and everything to do with what’s already running on your computer.