Claude credentials are
now a target
Not by cracking passwords or two-factor codes, but by stealing an already logged-in "session" — TechCrunch reported on September 8 that Claude subscribers are being targeted this way. Subscribers' usage quotas are being drained without their knowledge.
What's being stolen isn't the password —
it's an already-authenticated state
According to TechCrunch's reporting, attackers are using off-the-shelf infostealer malware to steal Claude login sessions from victims' computers, then impersonating them to burn through their usage quota. There's no need to guess a password or defeat two-factor authentication. The browser's proof of "already logged in" — a session cookie — is simply copied and replayed on another device, and the entire authentication process is skipped.
Scattered reports had circulated on social media and GitHub since around August, but TechCrunch's detailed account of the case of Grant de Swardt, an independent AI consultant based in the UK, gave the story a concrete shape. On his Claude Max 20x plan, he noticed on August 4 that his token usage kept climbing even though he wasn't working. The next day he disabled every tool connected to Claude and paused Cowork (automated tasks) and Dispatch (cloud execution), yet usage kept rising — in one observed interval his usage climbed from 45% to 55% while he did nothing at all.
| Conventional account takeover | Session-theft takeover |
|---|---|
| Guessing passwords / reused leaked credentials | Copying the browser's session cookie outright |
| Mostly blocked by two-factor authentication | 2FA doesn't help — the authenticated state itself is stolen |
| Login attempts tend to leave a trace | Looks like a legitimate login, easy to miss |
| Main battleground is the service side | Starts with malware on the victim's own device |
"We have no reason to believe that this malware is related to Claude, installed through Claude, or related to anything you did with Claude." — Anthropic, as reported to the press.
How the impersonation actually happens
What's targeted is the outcome of authentication, not the authentication procedure itself.
Infection by off-the-shelf malware
Identified families include the Windows infostealers Vidar, LummaC2, StealC, Redline and Acreed, plus Atomic Stealer on a small number of Macs. None of these were built specifically for Claude — they appear to be widely circulating generic malware being repurposed.
Theft of the session cookie
The cookie the browser holds as proof of "already logged in" is stolen outright. Even when the password itself was never exposed, this single artifact removes any need to reproduce the authentication process.
Replay and consumption elsewhere
The attacker loads the stolen cookie into a different device or browser and accesses the account as the victim. Subsequent use is hard to distinguish from a legitimate login, leaving only the bill for the consumed tokens behind.
The numbers being reported
These figures come from the de Swardt case as reported by TechCrunch — they are not a statistic covering every victim.
Anthropic is reported to have responded, for accounts it has flagged, by forcibly signing users out, invalidating existing authorizations, removing saved payment methods, and issuing partial refunds for unauthorized usage. Even so, de Swardt himself says he never received an individual warning email, and that he still has no way of determining how his own device was compromised. The remediation appears not yet fully comprehensive.
Where this matters, depending on who you are
The exposure differs for individual users, developers, and organizations.
Individual users
Stop reusing passwords across services and periodically review credentials your browser has stored. Shortening how long a session stays alive, and signing out early whenever behavior looks unfamiliar, both help.
Developers & engineers
Audit Claude Code OAuth tokens and API keys left sitting in CI environments or local machines. Shortening session lifetimes on shared or test machines, and monitoring for anomalous token consumption, makes early detection easier.
Enterprise & teams
Consolidating on SSO instead of a patchwork of individual accounts, with continuous audit-log monitoring for anomalous token usage, is a practical defensive line. Worth checking your plan's usage alerts as well.
What's still unclear, and what to do next
What this episode shows is less a novel vulnerability unique to AI services than an old technique — session theft — turning toward AI subscriptions as an easily-monetized target. Stolen usage quota has reportedly been used for tasks like drafting phishing content and modifying malware, so this is unlikely to remain a mere nuisance.
Still, plenty remains unresolved. Some victims have not identified how they were infected, the reported figures come from individual cases rather than a disclosed overall scale, and there is no way, at this point, to verify whether refunds and warnings have reached every affected account. Neither excessive optimism nor alarm is warranted — this is a story worth watching for follow-up.
Three recommended actions for now: (1) keep endpoint anti-malware software updated and run it regularly, (2) periodically check Claude and other key services for unfamiliar sessions or devices, and (3) for organizational use, move up your timeline for SSO adoption and audit-log monitoring.