Massive Claude Account Hijacking – Why Session Cookies Are the Real Threat

Incident Overview

On 31 August 2024 a large number of Claude users were forcibly logged out and their saved payment methods were cleared. Anthropic terminated the sessions and removed payment data to stop further consumption of the compromised account’s token quota.

Attack Vector

Information‑stealing trojans harvested browser cookies, session IDs, saved passwords, browsing history and wallet keys. The stolen session cookies allow attackers to continue using the account without needing the password or 2FA.

Anthropic listed the following Windows families: Vidar – steals passwords, history, wallet keys and session data. Lumma / LummaC2 – active in recent cracking tools and fake installers. StealC – lightweight MaaS used for rapid distribution. RedLine – long‑standing credential‑stealing family. Acreed – recent log‑stealer that uploads data in bulk.

macOS families: Atomic Stealer / AMOS – reads Keychain, browser cookies and application credentials.

These trojans can also compromise OpenAI, Google, GitHub, enterprise back‑ends, IM web clients and payment systems that store sessions in the browser.

Why Password Change and 2FA Are Insufficient

Session cookies act as a “pass” after authentication. An attacker who possesses a valid cookie can bypass a new password and 2FA until the session is explicitly revoked. The proper response is to invalidate all active sessions, clear browser cookies, and rotate API keys and billing information.

Monetisation of Stolen AI Quota

Compromised Claude sessions are monetised in two ways:

Shared “shell” websites that offer unlimited chat by consuming the victim’s quota.

API black markets where attackers generate API keys from compromised accounts and sell tokens to developers.

Detection Checklist

Signs of compromise include:

Unexpected quota exhaustion.

History of unknown conversations or prompts.

Repeated login prompts, especially from unusual geographic locations.

Missing payment methods.

Sudden spikes in API usage or unknown API keys.

Remediation Procedure (priority order)

Log out of all devices for core accounts (Google, Claude, OpenAI, GitHub, email, IM, cloud providers).

Clear all browser cookies, site data and remove unknown extensions.

Delete unfamiliar API keys, rotate production keys and revoke unknown OAuth apps.

Review billing statements and quota usage; freeze or contact support if anomalies are found.

Stop using cracked or unverified software packages.

If high‑risk malware (e.g., Lumma, RedLine, AMOS) is confirmed, back up essential data and reinstall the operating system.

Restrict AI agents’ permissions: limit filesystem access, require manual confirmation for high‑risk commands, and avoid full‑system privileges.

Security Boundary Redesign

Browsers should not be treated as secure vaults; use isolated profiles or dedicated devices for AI work. Separate API keys by environment, enforce budget caps and isolate keys per project. Local AI agents must not be fully trusted—require human approval for actions that affect credentials, cloud resources or payments.

Common Questions

Why can attackers keep using an account after a password change? They likely stole the session cookie, which remains valid until revoked.

Is 2FA still necessary? Yes, it blocks many password‑based attacks but does not protect against stolen session cookies.

What is the first step when quota anomalies appear? Log out of all devices, revoke sessions, delete unknown API keys, check billing, then clear browser cookies.

Can LLMs scan for malware? They can assist with log analysis and script generation, but confirmed high‑risk trojans still require system reinstall and credential rotation.

Which software sources are most dangerous? Cracked games, IDEs, “green” tools, activation patches, unknown installers and fake browser updates are common infection vectors.

How can teams lower AI account risk? Use dedicated accounts and keys, set usage limits, enable audit logs and avoid undocumented low‑cost endpoints.