Hackers Are Hijacking Claude Sessions to Steal AI Compute Tokens

Hackers deploy infostealer malware to steal Claude login sessions, which lets them mint unauthorized OAuth tokens and drain users' compute allowances. One subscriber saw their token usage spike from 0 to 49% in 12 minutes while completely inactive, while another burned through their max tokens for three consecutive days.

Anthropic is suspending impacted accounts and invalidating sessions, including issuing a £44.49 partial refund for a compromised $200-per-month subscription. The platform currently lacks a dashboard for itemized token usage, making it difficult for users to detect unauthorized third-party activity before their limits are exhausted. “We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers, then using those login sessions to access Claude accounts and consume their usage.” — Anthropic