Infostealers Targeting Claude Accounts: Session Token Theft Detection and Response Guide

---
title: Non-Browser Process Accessing Chromium Credential Stores
id: 4f8c2a71-9b3d-4e6f-a1c2-7d5e8f0a3b41
status: experimental
description: Detects processes other than the browser itself reading Chromium credential databases (Cookies, Login Data, Local State). A hallmark of infostealer collection activity targeting session cookies such as those used for claude.ai.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-thefts
  - https://attack.mitre.org/techniques/T1539/
  - https://attack.mitre.org/techniques/T1555/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1539
  - attack.t1555.003
logsource:
  category: file_event
  product: windows
detection:
  selection_files:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\'
      - '\Microsoft\Edge\User Data\'
      - '\BraveSoftware\Brave-Browser\User Data\'
    TargetFilename|endswith:
      - '\Cookies'
      - '\Login Data'
      - '\Local State'
      - '\Network\Cookies'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: selection_files and not filter_browsers
falsepositives:
  - Legitimate backup or EDR software reading browser profiles (exclude by signer)
  - Enterprise password managers with browser integration
level: high
---
title: Suspicious Access to Claude Code Credential File
id: 8e2d5b93-1c4a-4f7e-b2d3-9a6c1e0f5b82
status: experimental
description: Detects processes other than Claude Code itself accessing the Claude Code OAuth credential store (.claude/.credentials.json). Infostealers harvesting AI platform tokens target this file to replay authenticated sessions against Anthropic APIs.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-thefts
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '\.claude\.credentials.json'
  filter_legit:
    Image|endswith:
      - '\node.exe'
      - '\claude.exe'
      - '\claude-code.exe'
  condition: selection and not filter_legit
falsepositives:
  - Developers inspecting or backing up their own credential files
  - Asset inventory or DLP agents scanning user home directories
level: high
---
title: Process Execution from User-Writable Staging Directories
id: 2b7f4e16-8d5c-4a9b-c3e1-6f2d8a0c4e97
status: experimental
description: Detects executable launches from infostealer staging locations commonly used after malvertising or trojanized download delivery. Frequently the first observable of stealer families that harvest browser sessions and developer tokens.
references:
  - https://www.darkreading.com/cyberattacks-data-breaches/anthropic-users-infostealer-attacks-session-thefts
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
    Image|endswith: '.exe'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\brave.exe'
  filter_known:
    Image|contains:
      - '\AppData\Local\Microsoft\Teams\'
      - '\AppData\Local\slack\'
      - '\AppData\Local\Programs\'
  condition: selection_path and selection_parent and not filter_known
falsepositives:
  - User-installed per-user applications (Zoom, Discord installers)
  - Software updates delivered through browser downloads
level: medium

let BrowserProcs = dynamic(["chrome.exe", "msedge.exe", "brave.exe", "firefox.exe", "msedgewebview2.exe"]);
let ClaudeProcs = dynamic(["node.exe", "claude.exe", "claude-code.exe", "code.exe"]);
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\", "\\Microsoft\\Edge\\User Data\\", "\\BraveSoftware\\Brave-Browser\\User Data\\")
    and (FolderPath endswith "\\Cookies" or FolderPath endswith "\\Login Data" or FolderPath endswith "\\Local State" or FolderPath has "\\Network\\Cookies")
    or FolderPath endswith "\\.claude\\.credentials.json"
| extend IsBrowserStoreAccess = (FolderPath has "User Data") and not (InitiatingProcessFileName in~ (BrowserProcs)),
         IsClaudeCredAccess = (FolderPath endswith ".credentials.json") and not (InitiatingProcessFileName in~ (ClaudeProcs))
| where IsBrowserStoreAccess or IsClaudeCredAccess
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256, FolderPath, ActionType, AccountName
| sort by TimeGenerated desc

// Outbound connections from suspect processes within 10 minutes of credential-store access
let SuspectDevices = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where (FolderPath endswith "\\Cookies" or FolderPath endswith "\\Login Data" or FolderPath endswith "\\.claude\\.credentials.json")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "node.exe")
| summarize FirstAccess=min(TimeGenerated) by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| join kind=inner SuspectDevices on DeviceName, $left.InitiatingProcessFileName == $right.InitiatingProcessFileName
| where TimeGenerated between (FirstAccess .. FirstAccess + 10m)
| where RemoteIPType == "Public"
| project DeviceName, InitiatingProcessFileName, TimeGenerated, RemoteUrl, RemoteIP, RemotePort
| sort by TimeGenerated asc

-- Hunt: infostealer indicators targeting Claude sessions and browser credential stores
-- Looks for (a) non-browser processes with the Claude credential file path in their command line,
-- (b) recently created executables in stealer staging directories,
-- (c) running processes executing from user-writable paths.

-- (a) Processes referencing Claude credentials
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'credentials\\.json|claude\\.ai|console\\.anthropic'
  AND Name !~ 'claude|node'

-- (b) Recently dropped executables in infostealer staging locations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Temp/*.exe',
  'C:/Users/*/AppData/Roaming/*.exe',
  'C:/Users/*/Downloads/*.exe'
])
WHERE Mtime > now() - 1209600

-- (c) Claude Code credential file presence and last modification (timeline for possible theft)
SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/.claude/.credentials.json'])

# Claude Session Theft Triage Script — Security Arsenal IR
# Run as the affected user (and again as admin for full file visibility)

$Report = @()

# 1. Locate Claude Code credential files and report last-write time
Write-Host "[+] Enumerating Claude credential stores..." -ForegroundColor Cyan
$credFiles = Get-ChildItem -Path "C:\Users" -Recurse -Filter ".credentials.json" -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -like "*\.claude*" }
foreach ($f in $credFiles) {
    $Report += [PSCustomObject]@{
        Type = 'ClaudeCredentialFile'; Path = $f.FullName
        LastWrite = $f.LastWriteTime; Size = $f.Length
    }
    Write-Host "    FOUND: $($f.FullName) (LastWrite: $($f.LastWriteTime))" -ForegroundColor Yellow
}

# 2. Flag unsigned executables in infostealer staging directories modified in last 14 days
Write-Host "[+] Scanning staging directories for recent unsigned executables..." -ForegroundColor Cyan
$staging = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads")
foreach ($dir in $staging) {
    Get-ChildItem -Path $dir -Filter *.exe -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne 'Valid') {
                $Report += [PSCustomObject]@{
                    Type = 'UnsignedRecentExe'; Path = $_.FullName
                    LastWrite = $_.LastWriteTime; Size = $_.Length
                }
                Write-Host "    SUSPICIOUS: $($_.FullName) — signature: $($sig.Status)" -ForegroundColor Red
            }
        }
}

# 3. Check running processes executing from user-writable paths
Write-Host "[+] Checking running processes in user-writable paths..." -ForegroundColor Cyan
Get-Process | Where-Object {
    $_.Path -and ($_.Path -like "*\AppData\Local\Temp\*" -or $_.Path -like "*\AppData\Roaming\*")
} | ForEach-Object {
    $Report += [PSCustomObject]@{
        Type = 'RunningFromStaging'; Path = $_.Path
        LastWrite = $null; Size = $null
    }
    Write-Host "    RUNNING: $($_.Path) (PID $($_.Id))" -ForegroundColor Red
}

# 4. Check for Anthropic API keys exposed in user environment variables
Write-Host "[+] Checking for exposed Anthropic API keys..." -ForegroundColor Cyan
$envVars = [Environment]::GetEnvironmentVariables('User')
foreach ($k in $envVars.Keys) {
    if ($k -match 'ANTHROPIC|CLAUDE') {
        Write-Host "    EXPOSED KEY VARIABLE: $k — rotate this key immediately" -ForegroundColor Red
    }
}

# 5. Export findings
$out = "$env:USERPROFILE\Desktop\claude-session-triage-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
$Report | Export-Csv -Path $out -NoTypeInformation
Write-Host "`n[+] Report written to $out" -ForegroundColor Green
Write-Host "`n[!] NEXT STEPS (manual):" -ForegroundColor Magenta
Write-Host "    1. At claude.ai: Settings > log out of all other sessions"
Write-Host "    2. At console.anthropic.com: rotate ALL API keys"
Write-Host "    3. Re-run 'claude login' to re-issue Claude Code OAuth tokens"
Write-Host "    4. Reset the account password and review login email alerts"
Write-Host "    5. Isolate the endpoint if unsigned/recent EXEs were found — full IR triage required"