Hijacked sessions are draining Claude subscriptions

Anthropic is warning Claude subscribers that infostealer malware is hijacking login sessions and spending their token allowances, per TechCrunch's reporting. One $200-a-month subscriber, Grant De Swardt, saw his tokens burn through between August 4 and 5 while he wasn't working. Anthropic never sent him a warning email, and he got back only 44.49 pounds.

TechCrunch documents at least four affected accounts total. The malware doesn't crack passwords. It lifts an active session token off an infected machine. That token works on Anthropic's servers because it belongs to a real, signed-in user. Anthropic signed the affected users out, invalidated the stolen authorizations, and issued partial refunds.

Anthropic declined to give TechCrunch itemized usage reports for the affected accounts. Without that log, a subscriber has no way to notice a hijacked session until the token count looks wrong. By then the attacker has already spent the allowance.

Session-token theft isn't unique to Claude. Any subscription service that authenticates by session instead of per-request credentials carries the same exposure. A stolen Claude session is different because it buys compute directly. An attacker can spend that compute before anyone notices.