Anthropic recently confirmed that a wave of Claude accounts were compromised, not through a breach of their own systems, but through infostealer malware sitting on users' own devices. This is a great case study in how session hijacking actually works, and why it's more dangerous than simple password theft.
What happened
Infostealer malware (Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, Atomic Stealer on Mac) copied active Claude login sessions directly from users' browsers. Attackers reused those session cookies to access accounts and burn through paid usage, all without needing a password or triggering 2FA.
Why session theft bypasses 2FA
Two factor authentication protects the login step. But once you're authenticated, your browser holds a session cookie so you don't have to log in on every request. Malware that steals this cookie inherits an already-authenticated session, completely skipping the login flow that 2FA protects.
