Cybercriminals have found a new way to make money: they are hijacking other people's Claude accounts to avoid paying for the use of artificial intelligence. Anthropic has already started tracking such cases, deactivating the hijacked sessions and deleting the users' linked bank cards to protect their funds.
Cybercriminals have found a new way to make money: they are hijacking other people's Claude accounts to avoid paying for the use of artificial intelligence. Anthropic has already started tracking such cases, deactivating the hijacked sessions and deleting the users' linked bank cards to protect their funds.
The problem became known after a Reddit user under the nickname WorriedAssociate7029 shared a letter from the developers of Claude, The Register reports . The criminals use common malware — infostealers, including such well-known viruses as LummaC2, Vidar, StealC, RedLine, and Atomic Stealer.
Viruses hijack logged-in users' browsers:
logins and passwords;
cookie file;
active session tokens (which allows you to bypass two-factor authentication).
Having obtained this data, hackers use Claude's paid features or resell API access at the expense of the affected account holders.
The affected contributor admitted that he caught the virus through carelessness, having downloaded a hacked game from the Internet. Although he tried to clean his system (with the help of the AI Claude himself), the malware managed to transfer the Google and Claude sessions to the hackers.
The attackers were only able to spend the user's money thanks to the response of the Anthropic security system, which blocked suspicious activity in time, deleted payment data, and sent a warning.
The company emphasizes that the leak is not related to vulnerabilities in Claude itself. The application was not the source of infection - this is a standard attack by mass malware that collects all saved passwords one by one. However, now hackers have begun to specifically search for access to AI services among the stolen information.
AI tokens are expensive and have become a hot commodity on the black market. Experts advise users to be cautious with files from unverified sources, use two-factor authentication, and regularly check the list of active sessions in their accounts.
