Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-31 · high
Anthropic emailed affected users on August 30 after malware replayed live session cookies instead of stealing passwords, bypassing 2FA entirely.
Why now: Anthropic began notifying affected users on August 30, and Help Net Security published its writeup of the disclosure on August 31.
Anthropic started emailing affected users on August 30 after malware stole live Claude session cookies and replayed them to log in. Six commodity infostealer families did it: Vidar, LummaC2, StealC, RedLine and Acreed on Windows, Atomic Stealer on macOS, per Help Net Security's writeup. Anthropic invalidated the sessions, stripped saved payment methods, and refunded unauthorized charges.
None of these six are new or exotic. They're rental malware anyone can buy access to. What's different is what they grabbed. A stolen password still has to clear 2FA, SSO, device checks. A session cookie is the state that exists after all of that already said yes, so replaying it walks past every check you set up. Your account page won't show anything wrong, because the server sees you.
The tell people noticed: usage limits that seemed to refill and then drained overnight with nobody at the keyboard. If your Max weekly quota kept vanishing over the past few weeks and you blamed the plan, check again. The attackers weren't reading conversations. They were spending your paid inference.
For anyone running agent workloads on a subscription, that reframes what's at risk. Quota has resale value now, which makes a dev machine a target regardless of what's in its repos. The exposure runs through browser extensions, MCP servers, npm-installed CLIs, and skills pulled off GitHub, since each one can read the same cookie store.
Log out everywhere from account settings to force new sessions. Remove and re-add payment methods rather than trust that the strip caught everything. Run a malware scan. On macOS don't assume the platform protected you, since Atomic Stealer targets browser cookie stores and keychain items directly. I've been sloppier than I should be about what has read access to my browser profile folder. Agent tooling gets broad filesystem grants from me for convenience, and this disclosure is what pushed me to go audit it.
Each link below shares sources, entities, or timing with this story.
Alibaba uses Claude / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Alibaba uses Claude); both cover Anthropic, August, CLIs, GitHub; overlapping topics (agent, claude).
Claude uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude uses MCP); both cover Anthropic, August, Claude, GitHub; overlapping topics (account, agent, check).
Claude benchmarked against Codex / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude benchmarked against Codex); both cover Anthropic, August, CLAUDE, GitHub; overlapping topics (agent, claude).
Claude uses MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Claude uses MCP); both cover August, GitHub, Help Net Security, MCP; reported by the same outlet (helpnetsecurity.com).
Anthropic released Claude / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released Claude); both cover Anthropic, Claude, GitHub, None; overlapping topics (agent, claude).
Linked by a graph relationship (Anthropic released Claude); both cover Anthropic, Claude, None, Then; overlapping topics (access, account, agent, claude).
Claude uses MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude uses MCP); both cover August, CLAUDE, MCP, Then; overlapping topics (agent, claude).
Claude uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude uses MCP); both cover Anthropic, August, GitHub, MCP; overlapping topics (agent, claude, session).