In a concerning development for users of Anthropic's Claude AI platform, hackers have begun targeting the service with infostealer malware, leading to credential theft and account hijacking. Two distinct attack chains have been identified, allowing cybercriminals to access and misuse paid usage accounts while bypassing standard security measures such as two-factor authentication.

According to Anthropic, various malware families, including Vidar, Lumma, StealC, RedLine, and Acreed on Windows, as well as Atomic Stealer on macOS, have been silently capturing saved passwords, browser cookies, and other locally stored credentials from infected devices. This method allows attackers to steal authenticated session cookies instead of passwords, enabling them to replay a victim's session without needing to log in themselves.

Anthropic has responded by signing out affected accounts, removing stored payment methods, and issuing refunds for unauthorized charges. The company detected unusual activity after noticing that usage limits were being refilled and then rapidly drained while account owners were inactive.

In a related threat, security firm Huntress reported that attackers have weaponized Claude's infrastructure. Victims searching for the “Claude desktop app” on Bing were misled by sponsored ads that directed them to a malicious public Claude Artifact hosted on the legitimate claude.ai domain. This fake installer, disguised as ClaudeDesktop.exe, executed DLL sideloading, deploying a remote access trojan known as SectopRAT, which harvested sensitive information such as browser credentials and credit card data.

During a two-day period, at least 29 organizations were compromised, with the malicious page accumulating around 7,100 downloads before being removed by Anthropic. A new persistence technique has also emerged, where attackers disguise malicious commands within SKILL.md files, which are used for Claude's agent skills. This allows the malware to survive even after a full operating system reinstall if the tainted file is reintroduced.

In one instance, a Web3 founder nearly lost control of their crypto wallets after a Claude chat suggested a terminal command that executed immediately, pulling in the malware payload. In light of these incidents, Anthropic has emphasized that their account-side fixes do not eliminate malware from infected devices. Users are advised to run comprehensive malware scans, reset their email passwords with two-factor authentication, and scrutinize AI-suggested links or commands.

Organizations deploying Claude at scale should consider sandboxing AI agent environments and auditing configuration files for hidden instructions to prevent further incidents.