Listen to the episode
TLDR
Cybercriminals are using infostealer malware to copy active browser sessions for Claude, bypassing passwords and even multi factor authentication. Once they hijack a session, they consume the victim's usage credits and may trigger...
How it works
Cybercriminals are using infostealer malware to copy active browser sessions for Claude, bypassing passwords and even multi factor authentication. Once they hijack a session, they consume the victim's usage credits and may trigger...
Red flags
- Usage limits appear to refill and drain while you were not actively using Claude. You are unexpectedly logged out and your saved payment method is removed without your action. Antivirus or browser warns about malware, or saved passwords look modified
What to do
- 1Run a full real time anti malware scan on every device used to access Claude and remove any threats before logging back in
- 2Change passwords for your Claude email and any sensitive accounts stored in the affected browser, and enable 2FA everywhere
- 3Review card statements for unrecognized charges, disable auto reload of usage credits, and set a hard monthly spending cap
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/news/2026/09/infostealers-are-hijacking-claude-accounts-at-users-expenseFAQ
Is Infostealers are hijacking Claude accounts via stolen browser sessions a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Usage limits appear to refill and drain while you were not actively using Claude. You are unexpectedly logged out and your saved payment method is removed without your action. Antivirus or browser warns about malware, or saved passwords look modified
What should I do first?
Run a full real time anti malware scan on every device used to access Claude and remove any threats before logging back in; Change passwords for your Claude email and any sensitive accounts stored in the affected browser, and enable 2FA everywhere; Review card statements for unrecognized charges, disable auto reload of usage credits, and set a hard monthly spending cap
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.