Anthropic Deleted the Saved Card. The Password Was Never the Problem.

Anthropic deleted the saved card. The password was never the problem.

Some Claude users found themselves signed out of every device this week, with the payment method wiped from their account. The email explaining it came from Anthropic, and it described something that happened nowhere near Anthropic's servers. Malware already sitting on their own computers had copied their logged-in Claude session, and somebody else had been spending their usage with it.

BleepingComputer reported the campaign on 30 August 2026, working from a notice an affected customer published on Reddit. The technique involved is old and thoroughly documented. Where it is now being pointed is the new part, and it deserves a careful read, because at no stage did anyone break one of Anthropic's controls.

What Anthropic told its customers

"We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people's computers, then using those login sessions to access Claude accounts and consume their usage," the company wrote. It gave customers a symptom they could check themselves: if usage limits looked like they refilled and then drained while nobody was using Claude, that was probably this. Anthropic named the malware families it had identified so far. Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows, plus Atomic Stealer on a small number of Macs. Phones and tablets do not appear to have been involved. The company was emphatic that the infection had nothing to do with its product: general-purpose malware, usually arriving with an unofficial download or a malicious app. The customer who published the notice confirmed that in their case it came bundled with a pirated game.

The mechanism is worth slowing down for, because it explains why none of the usual protections applied. An infostealer is malware built to quietly copy saved passwords, browser cookies and application credentials off a machine and post them to a server. It does not need your password to get into an account you are already inside. When you log in anywhere, the site hands your browser a session cookie, a small token stored on disk that says this person has already proved who they are. The malware copies that file along with everything else. Replayed from the attacker's own machine, it drops them into your account mid-session. Multi-factor authentication (the second step, a code or a prompt on your phone) was not defeated here, because nobody ever arrived at the login page where it lives. The affected customer said as much: their two-factor protection made no difference, and Windows Defender never flagged the infection at all.

• Anthropic signed out the compromised sessions, removed saved payment methods so cards could not be charged, and is refunding charges it identifies as unauthorised.
• The company warned that signing a user out stops the stolen session but does not remove the malware, so the next login can be taken the same way. It said it may sign the same accounts out again.
• The investigation is ongoing and no victim count has been published. What is public is a customer notice, not a formal advisory.

Why it matters

Read the sequence closely and the newest fact in it is a commercial one. These stealer families have been vacuuming up everything indiscriminately for years, and the resulting logs are traded in bulk. Somebody has now gone through that pile specifically hunting for Claude sessions, which means an AI subscription is finally worth the labour of sorting for. Metered compute resells, so draining a stranger's limits is a business rather than a prank. For your own organisation the exposure is much larger than the invoice, because whatever sits in that account travels with the session, and the things people paste into an assistant all day are the things they would never put in an email: source code, contract drafts, incident notes, customer records. Most companies also have no inventory of who is signed in to which AI tool, and a good share of those accounts sit outside single sign-on entirely, so no administrator has a revoke button to press when a laptop turns out to be infected. The systemic shift has been building for a decade. The industry hardened the login event and left the artifact that login produces sitting in a file on disk with almost nothing guarding it, so attackers went to the artifact instead. AI accounts are simply the newest entry on the list of things worth stealing, and given what passes through them, they will not be the cheapest.

What to do about it

1. Bring every AI tool inside single sign-on and treat it as production access. A session you cannot see in your identity provider is a session you cannot terminate on the morning you learn a machine was compromised.
2. Turn on device-bound sessions wherever the browser offers them, and shorten session lifetimes everywhere else. Chrome's Device Bound Session Credentials tie a session to a private key held in the machine's security chip, which makes a copied cookie inert anywhere else, and it is the only control here that still works after the endpoint is lost.
3. Rebuild an infected machine rather than cleaning it, and rotate every credential it held. These families are built to persist and to reinstall themselves, and the compromise was never limited to one account, so a targeted removal leaves you guessing about which of the other 60 saved logins are still yours.

Bottom line

The uncomfortable detail is not the malware, which is ordinary and years old, and is stopped by the same endpoint controls it has always been stopped by. It is that a criminal sorting through stolen data now considers an AI login worth pulling out by hand. Take that to your next security meeting as a question about your own environment rather than a story about somebody's pirated game: if an employee's laptop were compromised tonight, could anyone at your company find and kill their AI sessions tomorrow, and would you have any idea what those sessions contained?