Stolen Claude session cookies accessed corporate Gmail accounts
Anthropic reported that stolen session cookies were used to access paid accounts.
1How does session cookie theft work?
Infostealer malware steals Claude session cookies from users' computers and uses them in paid accounts. This method bypasses two-factor authentication and SSO. Stolen cookies provide access to accounts without login credentials. Anthropic detected this campaign, signed out affected accounts, removed saved payment methods, and refunded detected charges.
2Which infostealer malware were used?
Anthropic reported the use of Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and a small number of Atomic Stealer on Macs. These malware copy browser session cookies and saved passwords. Users' Claude sessions were among the data collected by these malware.
3How were corporate accounts affected?
Anthropic stated that affected accounts were self-serve, card-billed accounts not managed by corporate identity providers. These accounts cannot be signed out from admin consoles. SSO's revocation and visibility features are not available for these accounts.
4What was Anthropic's response?
Anthropic notified affected users via email, signed out accounts, removed saved payment methods, and refunded detected charges. The company detected the campaign through usage meters, noticing limits being refilled and drained while users were not actively using Claude.
5How were users impacted?
BleepingComputer reported that one Reddit user traced the infection to a pirated game. However, Anthropic did not provide numbers on how many users were affected or whether SSO-protected Team or Enterprise accounts were compromised. The company did not respond to VentureBeat's questions about the scale of the breach.
6Risks of personal subscriptions
Personal Claude subscriptions on managed laptops pose risks. LayerX data shows 47% of enterprise AI conversations run through personal identities, with Claude at 61%. This increases the risk of corporate data exposure through stolen cookies.
7Fake Claude download pages
In July, attackers hosted a spoofed Claude download page on the claude.ai domain and directed employees there via a Bing ad. Huntress documented this FakeAgent campaign, which compromised employees at 29 organizations in two days using SectopRAT. The fake page collected ~7,100 downloads before removal.
8Google Workspace connector risks
Claude accounts can integrate with Google Workspace connectors, allowing personal Pro subscriptions to maintain live authorizations to Gmail inboxes or Drive folders. If this inbox is a work email, attackers with stolen cookies gain read access evaluated only once when the employee clicked 'allow.'
9Lack of corporate control
On personal plans, employees retain these grants. No Claude tenant admin can sign these accounts out, and Workspace/Entra admins who could revoke the underlying grants rarely know they exist. This creates significant corporate security gaps.
10LLMjacking campaigns
CrowdStrike's 2026 Threat Hunting Report documented an LLMjacking campaign that pushed ~200,000 API requests through compromised cloud account AI access in two minutes. Adam Meyers told Axios criminals have been buying/selling stolen ChatGPT, Claude, and Gemini credentials since late 2022.
11Conclusions and recommendations
This incident shows session cookie theft is becoming the new credential theft. Corporate users should avoid personal subscriptions on managed devices, and companies must tighten oversight of employee AI tool usage. Identity providers should also review authorizations more frequently.