Claude Quota Mysteriously Drained? Hackers Begin Stealing Login Sessions, Even 2FA Can’t Stop Them

Beating AI News: Anthropic is sending security alerts to select Claude users after the company discovered hackers stealing Claude login sessions from malware-infected devices to access accounts and deplete user quotas. Users on Reddit have already shared screenshots of the alert emails they received. Unlike stolen passwords, the compromised assets are already-authenticated browser sessions, which let attackers impersonate users directly without re-entering passwords or completing two-factor authentication (2FA). One affected user noted they logged in via Google and had 2FA enabled, yet their browser cookies and session IDs were still stolen together. Anthropic named several information-stealing trojans in the email, including Windows-based Vidar, LummaC2, StealC, RedLine, Acreed, and Mac-based Atomic Stealer (AMOS). These are all malware designed to steal browser cookies, passwords, and other data, not security flaws in Claude itself. The user added they had previously downloaded pirated software, which likely led to the infection. Anthropic said it has terminated detected suspicious login sessions, removed saved payment methods from affected accounts, and resolved related unauthorized charges. The company also emphasized that changing passwords alone will not fix the issue—if malware on the device is not removed, newly generated login sessions may still be stolen.