Infostealers have successfully exploited a critical gap in Anthropic's account security infrastructure by hijacking Claude session cookies and replaying them into paid accounts, completely circumventing two-factor authentication and single sign-on protections.
The attack targets self-serve, card-billed Claude accounts that operate outside corporate identity management systems. These accounts lack the administrative oversight that enterprise deployments enjoy. Attackers captured session cookies through infostealer malware, then used those cookies to authenticate directly into accounts without ever triggering the login page or 2FA checks that would normally block unauthorized access.
Anthropic identified the campaign and notified affected users. The company signed out compromised accounts, removed saved payment methods, and issued refunds for fraudulent charges. Anthropic named six infostealer families involved in the campaign but did not disclose the total number of compromised accounts or the full scope of financial damage.
The vulnerability exposes a fundamental asymmetry in how Claude handles different user categories. Customers using Claude through corporate SSO systems benefit from centralized revocation and visibility. If an account is compromised, IT administrators can immediately revoke access across the platform. Self-serve users lack this protection entirely. When a session cookie is stolen, no admin console can force a sign-out. The attacker maintains access until Anthropic detects the breach and acts manually.
Session-cookie replay attacks are well-understood in security research but remain effective because they operate below the authentication layer. Once an attacker holds a valid session token, the system treats subsequent requests as legitimate. Two-factor authentication protects the login process, not the session itself. Single sign-on offers similar protection at the access boundary. Neither stops an attacker already holding a valid session.
The practical impact extends beyond individual account compromise. Because Claude can integrate with corporate Gmail and other enterprise systems through OAuth grants, an attacker controlling a Claude account gains potential access to downstream services. Grants issued through a compromised account may allow unauthorized email access or other corporate resource abuse. The attacker doesn't need to revoke the grant. It persists until the user manually removes it or Anthropic detects and forces revocation.
This pattern highlights a recurring tension in AI platform security. Self-serve models prioritize user convenience and onboarding speed. Enterprise deployments sacrifice some convenience for centralized control and audit visibility. The gap between these tiers creates an asymmetric risk surface. A compromised self-serve account can pivot into corporate systems that expect the account's legitimacy.
Infostealers themselves remain persistent threats. They distribute through cracked software, browser extensions, and malicious downloads, collecting browser cookies, credentials, and session tokens automatically. Users typically don't know they're infected. The cookies may sit inactive for days or weeks before an attacker replays them, making detection difficult.
Anthropic's response was reactive. The company detected the campaign, notified users, and cleaned up. Stronger defenses would include session-binding techniques that tie cookies to specific devices or networks, making replay attacks harder even if the cookie is stolen. Risk-based authentication could flag suspicious replayed sessions based on geolocation mismatches or unusual access patterns. OAuth grant scoping could limit downstream access from self-serve accounts.
For users, the lesson remains practical. Malware hygiene matters. Infostealers work because users run untrusted software. Browsers and operating systems accumulate cookies that persist for months, making them valuable targets. Until session security improves, users operating sensitive accounts should assume their session tokens could be stolen and should monitor for unauthorized access.