Back to Intelligence

Infostealer Malware Hijacking Claude Sessions: Detection and Remediation Guide for Defenders

SA
Security Arsenal Team
August 30, 2026
12 min read

Anthropic has begun warning Claude users that infostealer malware resident on their machines has harvested active Claude login sessions, giving attackers full access to compromised accounts without ever needing a password. The stolen session tokens are then used to consume the victim's Claude usage quota — effectively turning hijacked AI accounts into a monetizable commodity.

This is not a vulnerability in Anthropic's platform. There is no CVE here, no patch to deploy to Anthropic infrastructure. The attack surface is the endpoint: commodity infostealer families that have spent years perfecting browser cookie and session-token theft are now treating AI platform sessions the same way they have long treated Google, Microsoft, and cryptocurrency wallet sessions. If your organization allows employees to access Claude (or any SaaS AI platform) from corporate or BYOD endpoints, those sessions are exactly one infostealer infection away from abuse.

For defenders, the stakes extend beyond a drained usage quota. A hijacked Claude session gives an attacker access to conversation history — which in enterprise contexts can include pasted source code, internal documents, credentials, customer data, and business strategy. This is a data exposure event dressed up as a billing nuisance. Treat it accordingly.

Technical Analysis

Attack Chain

The attack follows the well-documented infostealer playbook, with AI platform sessions as the monetization target:

  1. Initial infection. Infostealers typically arrive via malvertising, SEO-poisoned downloads of cracked software or "free AI tools," trojanized installers, phishing attachments, or malicious browser extensions. The current wave of infostealers is frequently distributed as fake AI utilities and "jailbroken" LLM clients — a lure set that directly targets the same users likely to have active Claude sessions.

  2. Browser credential and cookie extraction. Once resident, the stealer enumerates installed Chromium-based and Gecko-based browsers, locates the cookie databases (Cookies SQLite files under %LOCALAPPDATA%\Google\Chrome\User Data\, %APPDATA%\Mozilla\Firefox\Profiles\, and equivalents for Edge, Brave, Opera, Arc), and decrypts them. On Windows, Chromium cookies are encrypted with keys protected via DPAPI; stealers routinely extract the master key from Local State and decrypt offline, or use process injection / direct browser memory access to bypass newer application-bound encryption protections.

  3. Session token exfiltration. Stolen session cookies (including active claude.ai sessions) are bundled with saved passwords, autofill data, crypto wallet artifacts, and system fingerprints, then exfiltrated to attacker-controlled C2 infrastructure or Telegram bots.

  4. Account abuse. Attackers replay the session cookie from their own infrastructure. Because the session is already authenticated, MFA is irrelevant — the token itself is the proof of identity. The hijacked account is then used to run workloads (often automated, high-volume API-style usage via the web session) until usage limits are hit, sold on, or exploited for access to conversation history.

Why Session Theft Defeats Your Controls

  • MFA does not protect a stolen session. MFA protects the authentication event, not the post-authentication token. This is the same reality that has driven pass-the-cookie and adversary-in-the-middle phishing for years.
  • No anomaly at the identity layer. Session replay can appear as a valid authenticated session. Detection depends on IP/ASN deviation, impossible travel, user-agent anomalies, and usage-pattern deviation at the SaaS layer — most of which requires the vendor (Anthropic, in this case) to surface telemetry to the user, which they are now doing via these warnings.
  • The endpoint is the root cause. Every stolen session traces back to an unmanaged or inadequately protected endpoint running the stealer. The fix is endpoint-centric.

Exploitation Status

This is confirmed, in-the-wild abuse, not theoretical. Anthropic is actively notifying affected users. There is no CVE and no CISA KEV entry because this is malware tradecraft, not a product vulnerability. Infostealer-as-a-service ecosystems remain one of the most active criminal market segments, and session resale ("logs" markets) is a mature economy.

Detection & Response

The highest-fidelity detections target the behaviors infostealers cannot avoid: reading browser credential stores, spawning scripted children of browsers or LOLBins, and connecting out to exfiltration infrastructure immediately after execution. These rules are tuned to behaviors, not hashes, because stealer hashes rotate daily.

SIGMA Rules

YAML
---
title: Browser Credential Store Access by Non-Browser Process
id: 4f1a9c2e-7b3d-4e5f-8a6c-2d1e9b7a5f3c
status: experimental
description: Detects processes other than the browser itself accessing Chromium or Firefox credential/cookie stores, a hallmark of infostealer session and cookie theft including Claude session cookies.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/
  - https://attack.mitre.org/techniques/T1555/003/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_access
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\User Data\Default\Cookies'
      - '\User Data\Default\Network\Cookies'
      - '\User Data\Default\Login Data'
      - '\User Data\Local State'
      - '\Mozilla\Firefox\Profiles\'
  selection_profiles:
    TargetFilename|contains:
      - 'cookies.sqlite'
      - 'logins.json'
      - 'key4.db'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  filter_known_apps:
    Image|endswith:
      - '\OneDrive.exe'
      - '\MsMpEng.exe'
      - '\SearchIndexer.exe'
  condition: (selection_paths or selection_profiles) and not 1 of filter_*
falsepositives:
  - Endpoint backup and sync agents scanning user profile directories
  - EDR/AV engines performing file scans (tune per environment)
level: high
---
title: Script Interpreter Spawning Browser Process
id: 8c2e5d1a-4f6b-4a9c-9d3e-1b7a5c2e8f4d
status: experimental
description: Detects script interpreters or LOLBins launching browser processes, a common infostealer pattern used to read browser memory or trigger headless sessions for cookie harvesting of SaaS platforms such as Claude.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_flags:
    CommandLine|contains:
      - '--headless'
      - '--remote-debugging-port'
      - '--user-data-dir'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Legitimate automation frameworks (Selenium, Playwright, Puppeteer) - scope by known automation service accounts/paths
level: medium
---
title: DPAPI Master Key Access by Uncommon Process
id: 2b7d4f1c-9e5a-4c8b-8d2f-6a1c3e9b5f7a
status: experimental
description: Detects access to the Windows DPAPI master key store by non-system processes, used by infostealers to decrypt Chromium cookie and login databases containing SaaS session tokens.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-warns-infostealer-malware-is-hijacking-claude-sessions-to-drain-usage/
  - https://attack.mitre.org/techniques/T1555/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1555.004
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Microsoft\Protect\'
  filter_system:
    Image|endswith:
      - '\svchost.exe'
      - '\lsass.exe'
      - '\System'
      - '\MsMpEng.exe'
  condition: selection and not filter_system
falsepositives:
  - Credential management tools and password managers (inventory and allowlist explicitly)
level: high

KQL (Microsoft Sentinel / Defender)

Hunt for non-browser processes touching browser credential stores, followed by outbound connections from unsigned or user-directory executables — the classic steal-and-exfil sequence. Run this across the 7-day window preceding any Anthropic session-hijack warning a user reports.

KQL — Microsoft Sentinel / Defender
let BrowserStorePaths = dynamic(["User Data\\Default\\Cookies", "User Data\\Default\\Network\\Cookies", "User Data\\Default\\Login Data", "Local State", "cookies.sqlite", "logins.json", "key4.db", "Microsoft\\Protect"]);
let SuspiciousFileAccess =
    DeviceFileEvents
    | where Timestamp > ago(7d)
    | where FolderPath has_any (BrowserStorePaths)
    | where not(InitiatingProcessFileName has_any ("chrome.exe","msedge.exe","firefox.exe","brave.exe","MsMpEng.exe","SearchIndexer.exe"))
    | summarize FirstSeen=min(Timestamp), AccessCount=count(), FilesAccessed=make_set(FileName, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256;
SuspiciousFileAccess
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | summarize FirstOutbound=min(Timestamp), RemoteIPs=make_set(RemoteIP, 10), RemoteUrls=make_set(RemoteUrl, 10) by DeviceName, InitiatingProcessFileName
) on DeviceName, InitiatingProcessFileName
| extend ExfilWithinMinutes = datetime_diff('minute', FirstOutbound, FirstSeen)
| project DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FirstSeen, AccessCount, FilesAccessed, FirstOutbound, ExfilWithinMinutes, RemoteIPs, RemoteUrls, InitiatingProcessSHA256
| order by FirstSeen desc

A companion query for SaaS-layer context: if you ingest Claude or other AI platform admin/audit logs (or proxy logs for claude.ai), look for session reuse from new ASN/geography for a given user within a short window — impossible travel on an already-authenticated session is the tell for cookie replay.

KQL — Microsoft Sentinel / Defender
CommonSecurityLog
| where Timestamp > ago(14d)
| where RequestURL has "claude.ai" or DestinationHostName has "claude.ai"
| summarize Sessions=count(), SourceIPs=make_set(SourceIP, 10), UserAgents=make_set(RequestClientApplication, 5), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by SourceUserID
| where array_length(SourceIPs) > 3
| order by Sessions desc

Velociraptor VQL

Endpoint triage artifact: enumerate running processes with executables in user-writable directories that have an open handle pattern consistent with browser store access, plus network connections. Deploy this immediately on any host tied to a notified user.

VQL — Velociraptor
-- Infostealer triage: unsigned/uncommon processes running from user-writable
-- paths with active outbound connections (steal-then-exfil footprint)
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(AppData|Temp|Public|Downloads)\\'
  AND NOT Exe =~ '(?i)(Microsoft\\Teams|OneDrive|Spotify|Discord|Slack)'

-- Correlate: outbound connections from the same suspicious processes
SELECT Pid, Name, Exe, Status, DestAddr, DestPort
FROM netstat()
WHERE Status =~ 'ESTAB'
  AND Exe =~ '(?i)(AppData|Temp|Public)\\'
  AND NOT DestAddr =~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

For forensic confirmation of cookie store access, also collect $Recycle.Bin-free artifacts: prefetch for the suspect binary, the browser Cookies and Login Data file MAC times, and %APPDATA%\Microsoft\Protect\ directory metadata around the infection window.

Remediation Script

Run this on any Windows host associated with a user who received an Anthropic session-hijack warning, or where hunt queries fired. It inventories browser credential store access artifacts, identifies suspicious unsigned binaries in user paths, checks run-key persistence, and forces the defensive baseline (kill sessions, rotate credentials).

PowerShell
# Infostealer response triage - run elevated, capture output for IR case file
$report = "C:\IR_StealerTriage_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
"=== Infostealer Triage: $env:COMPUTERNAME / $env:USERNAME ===" | Out-File $report

# 1. Unsigned executables in user-writable paths with recent modification
"`n[+] Recent unsigned binaries in user-writable paths:`n" | Out-File $report -Append
Get-ChildItem "$env:LOCALAPPDATA","$env:APPDATA","$env:TEMP","C:\Users\Public" -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') { "{0} | {1} | {2}" -f $_.FullName, $_.LastWriteTime, $sig.Status }
  } | Out-File $report -Append

# 2. Persistence: Run keys, startup folder, scheduled tasks from user paths
"`n[+] Persistence check (Run keys / Startup):`n" | Out-File $report -Append
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run*',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run*' -ErrorAction SilentlyContinue |
  Out-String | Out-File $report -Append
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'AppData|Temp|Public' } |
  Select-Object TaskName, TaskPath, @{n='Exe';e={$_.Actions.Execute}} | Out-String | Out-File $report -Append

# 3. Browser cookie store last-access timestamps (stealers touch these)
"`n[+] Browser credential store timestamps:`n" | Out-File $report -Append
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Network\Cookies",
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Local State",
  "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Network\Cookies",
  "$env:APPDATA\Mozilla\Firefox\Profiles" -Recurse -ErrorAction SilentlyContinue |
  Select-Object FullName, LastAccessTime, LastWriteTime | Out-String | Out-File $report -Append

# 4. Active outbound connections from suspicious processes
"`n[+] Active connections from user-path processes:`n" | Out-File $report -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p.Path -match 'AppData|Temp|Public') {
      "{0} ({1}) -> {2}:{3}" -f $p.Path, $p.Id, $_.RemoteAddress, $_.RemotePort }
  } | Out-File $report -Append

"`n[!] Manual actions required: revoke all Claude/SaaS sessions, reset credentials from a CLEAN device, reset MFA tokens.`n" | Out-File $report -Append
Write-Host "Triage complete -> $report"

Remediation

Because this threat has no patch, remediation is layered across the account, the endpoint, and the organization:

Immediate (user/account level):

  1. Revoke all active sessions immediately. In Claude settings, sign out all sessions/devices. Do this for every SaaS platform accessed from the affected machine — if the Claude cookie was stolen, so were Google, Microsoft 365, GitHub, and every other session.
  2. Reset the account password from a known-clean device. Never rotate credentials on the infected host; the stealer will harvest the new password in real time.
  3. Re-enroll MFA (rotate TOTP seeds where possible — some stealers capture seeds from authenticator exports and browser-based authenticators).
  4. Review conversation history for sensitive data exposure: pasted credentials, internal code, customer data. If present, scope this as a data incident and follow your breach-notification obligations (HIPAA/PCI/state laws as applicable).
  5. Check billing and usage for unauthorized consumption and report it to Anthropic support per the guidance in their notification email.

Endpoint level: 6. Isolate the host from the network and run full EDR + offline AV scans. Infostealers frequently act as loaders for follow-on payloads (RATs, ransomware precursors) — a stealer detection means the host needs full IR triage, not just a malware quarantine. 7. Reimage if the stealer family or dwell time is unknown. Infostealers routinely install persistence and secondary payloads; cleanup is unreliable. 8. Audit installed browser extensions and remove anything not on an allowlist. Malicious extensions are a growing session-theft vector. 9. Block execution from user-writable directories via WDAC/AppLocker, and enable attack surface reduction rules — particularly "Block credential stealing from lsass" and script/LOLBin child-process rules.

Organizational level: 10. Shorten SaaS session lifetimes and bind sessions to device/IP where the platform supports it. 11. Adopt phishing-resistant auth (FIDO2/passkeys) — it doesn't stop cookie theft, but it prevents re-authentication after revocation and eliminates password reuse fallout from the same stolen logs. 12. Instrument SaaS-layer telemetry. Route proxy/CASB logs for AI platforms into your SIEM so ASN-deviation and impossible-travel analytics can fire on session replay (see KQL above). 13. Govern AI tool usage. Unmanaged "shadow AI" accounts on unmanaged endpoints are the highest-risk population here. Move users to enterprise plans with SSO/SCIM so sessions inherit your conditional access policies. 14. Threat-hunt retroactively. Any user who received Anthropic's warning should trigger a 14–30 day retrohunt using the detections above across all hosts they have used — one confirmed stealer infection usually means more in the same environment.

There are no vendor patches or CISA deadlines associated with this campaign; monitor Anthropic's status and trust pages for updated guidance and any newly offered session-security controls.

Conclusion

Anthropic's warning is a useful forcing function: AI platform accounts are now first-class targets in the infostealer economy, and session tokens — not passwords — are the prize. The defense is unglamorous and well-understood: hardened endpoints, execution control, rapid session revocation, and telemetry that can catch a replayed cookie. If your IR plan doesn't yet include a "stolen SaaS session" playbook, this story is your cue to write one before the notification email lands in your users' inboxes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

criticalzero-daycvepatch-tuesdayexploitvulnerability-disclosureinfostealer-malwaresession-hijackinganthropic-claudebrowser-cookie-theft

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action