Claude users targeted by infostealer malware, Anthropic warns
What's the story
Anthropic, the company behind the AI service Claude, has issued a warning to users about a recent security breach. The firm revealed that hackers have been stealing active login sessions through infostealer malware. These stolen sessions are then used by the attackers to access user accounts and exhaust their usage limits. This leaves affected users signed out and removes their saved payment methods from the platform.
Attack method
Attackers used infostealer malware to access user accounts
Anthropic has confirmed that the theft of Claude sessions was carried out using common infostealer malware, not a vulnerability in its system.
The company said these attacks were launched from compromised computers and targeted users who may have noticed unusual behavior in their usage limits on the platform.
If your account's usage appeared to reset before being quickly exhausted, it may have been accessed by an unauthorized party.
Remedial measures
Anthropic will delete affected users' saved payment information
In response to this security breach, Anthropic is taking immediate action by revoking compromised sessions.
The company is signing affected users out and deleting their saved payment information. It has also promised to refund any charges that its investigation finds were unauthorized.
However, it clarified that while these account-level measures can prevent further misuse of a stolen session, they cannot remove malware from an infected computer.
Malware source
Malware can enter your system through malicious downloads
A user who was affected by this attack revealed that they had downloaded a pirated game before their computer was compromised. This incident highlights how malware can enter a system through malicious applications or downloads.
Anthropic has also found several Windows-based infostealers in its investigation, including Vidar, LummaC2, StealC, RedLine, and Acreed. It also discovered Atomic Stealer (AMOS) on some Mac computers.
Security concerns
Users should remove malware from their computers
Anthropic's investigation into the matter suggests a larger endpoint-security problem rather than a breach of its own infrastructure.
The company has not revealed how many accounts have been affected by this attack. However, it is urging users to remove malware from their computers and change relevant credentials.
Users should also be cautious while downloading software, especially from unofficial sources, to avoid falling victim to such attacks in the future.