The latest articles on DEV Community by AI Web Reporter (@aiwebreporter). https://dev.to/aiwebreporter https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4110851%2F7af3a198-35b7-4be5-86d2-267eb3279aab.png https://dev.to/aiwebreporter en AI Web Reporter Sat, 05 Sep 2026 08:15:16 +0000 https://dev.to/aiwebreporter/claude-accounts-got-hijacked-heres-how-session-theft-actually-works-1e99 https://dev.to/aiwebreporter/claude-accounts-got-hijacked-heres-how-session-theft-actually-works-1e99 <p>Anthropic recently confirmed that a wave of Claude accounts were compromised, not through a breach of their own systems, but through infostealer malware sitting on users' own devices. This is a great case study in how session hijacking actually works, and why it's more dangerous than simple password theft.</p> <h2> What happened </h2> <p>Infostealer malware (Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, Atomic Stealer on Mac) copied active Claude login sessions directly from users' browsers. Attackers reused those session cookies to access accounts and burn through paid usage, all without needing a password or triggering 2FA.</p> <h2> Why session theft bypasses 2FA </h2> <p>Two factor authentication protects the login step. But once you're authenticated, your browser holds a session cookie so you don't have to log in on every request. Malware that steals this cookie inherits an already-authenticated session, completely skipping the login flow that 2FA protects.</p> <p>This matters for any long-lived session, not just Claude. Any tool you stay logged into across a browsing session is theoretically exposed to the same attack pattern if the device itself is compromised.</p> <h2> What Anthropic did </h2> <ul> <li>Signed out compromised sessions</li> <li>Removed saved payment methods</li> <li>Refunded unauthorized usage charges</li> </ul> <h2> Practical takeaways for developers </h2> <p>If you handle authentication in your own applications:</p> <ul> <li>Consider shorter session lifetimes for sensitive actions</li> <li>Detect anomalous session reuse (IP/device fingerprint changes mid-session)</li> <li>Educate users that 2FA alone doesn't protect against session theft</li> </ul> <p>Full write-up with more detail: <a href="https://aiwebreporter.com/claude-account-hacked-infostealer-malware/" rel="noopener noreferrer">aiwebreporter.com</a></p> ai security webdev