Malware Is Now Stealing Claude Sessions To Drain Paid AI Usage – How Does That Work?

Hackers have officially found a way to make innocent subscribers foot their hefty AI bills, forcing Anthropic into full cleanup mode with forced logouts and mass refunds.

Instead of pulling off a cinematic breach of Claude itself, malicious parties let basic laptop malware pinch authenticated browser cookies. They used these stolen tokens, inherited active user sessions and ran expensive prompt allowances without ever knowing the password.

Infostealers have typically targeted banking credentials, crypto wallets and high-value SaaS accounts because those could be monetised through fraud or resale. The Claude incident introduces a different target: paid AI usage. An attacker with access to a hijacked Claude session can consume that account’s token quota by running their own workloads without paying for it.

Large corporate allowances are real cash, which makes enterprise accounts a prime target for compute theft. Intruders get a surprisingly long runway to burn through compute because high-volume API requests look completely normal on standard usage dashboards.

The Anatomy Of A Session Hijack

It all happens in five clear stages. A user machine catches infostealer malware via cracked software, trojanised files, sketchy adverts or phishing attachments. From there, the script combs through local browser profiles to collect saved passwords, form data and essential session cookies. Web services rely on those specific browser tokens after a valid sign-in, and use them as proof to grant ongoing access without requiring another login.

Next, the extracted cookies are funneled back to the intruder’s setup. Loading a stolen token into a browser or automation script lets the attacker walk right in, as the web app sees a valid active session and asks for no extra credentials. This mechanic neatly avoids two-factor authentication, which only checks identity during the initial login prompt. With the session token compromised, the attacker gets full access to the account instantly.

In the Claude case, the attacker with a hijacked session could make API calls, consume usage quotas and run prompts as if they were the account holder. Unlike a bank transfer, which triggers alerts and reversal processes, quota drain may not be noticed until limits are hit or an unexplained bill arrives. This delay is useful for attackers.

Once Anthropic spotted the suspicious account activity, it took swift action to limit the damage. The company logged out compromised profiles, cleared stored credit cards and issued refunds for identified fraudulent charges in line with its direct updates to impacted users.

Why Are AI Accounts Worth Stealing?

Enterprise subscriptions ordinarily have large prompt allowances that scripts can burn through rapidly. For an unauthorized user needing raw processing power for big automation tasks, a compromised team account offers an endless supply of free usage. Siphoning off a cookie takes little effort, but the financial value of consumed tokens makes it an extraordinarily lucrative trade.

This creates a new category of account takeover that businesses should certainly treat as a direct financial risk, not just a technical glitch. While standard data breaches come with quantifiable price tags, token draining is trickier because the financial damage subtly stacks up over time. Companies that skip usage alerts and treat corporate AI accounts like low-risk perks are handing intruders the exact environment needed to make these attacks lucrative.

What Now For Enterprise Security?

Rule number one: signing in again on an infected laptop is likely a waste of time.

With infostealer malware active, every new login simply generates a new cookie for intruders to swipe all over again. The physical device requires a complete wipe or rebuild before accessing critical services. IT teams should revoke active sessions from a clean machine, and strip saved payment cards until the endpoint is fully secured.

At the organisational level, AI accounts should be managed the same way as any other high-value SaaS identity. That means centralising access through SSO with conditional access policies, setting alerts for unusual consumption patterns, enforcing per-user or per-team rate limits and, where the platform supports it, using API keys scoped to minimal permissions and the ability to revoke quickly. Session lifetimes should be shortened for accounts with billing access, and re-authentication should be required for actions like adding payment methods or changing plan limits.

The Anthropic incident is a clear example of infostealers targeting AI subscriptions; the same mechanism threatens any browser-authenticated service subject to spending caps or usage quotas. Carrying out the attack doesn’t take specialized skill beyond running basic, off-the-shelf malware that has floated around the web for years.

The exploit itself hasn’t changed one bit; the target on the other end just became more lucrative.