Claude users are discovering their login sessions have been stolen and their paid usage quotas drained by people they've never heard of. Anthropic announced yesterday that attackers using common infostealer malware, Vidar, LummaC2, StealC, RedLine, Acreed on Windows, and Atomic Stealer on macOS, have been lifting active Claude sessions from compromised PCs, then using those sessions to access accounts and burn through paid credits.
The mechanics are straightforward: these malware families harvest saved passwords, browser cookies, and locally stored credentials from infected machines. When an infostealer captures an authenticated browser session cookie, it doesn't need the user's password. The attacker just replays the cookie and gets full account access.
Anthropic is signing affected users out, removing saved payment methods, and refunding charges it identifies as unauthorized. That's the immediate damage control. But there's a persistence problem worth noticing.
Huntress researchers found a second attack chain that's harder to clean. Between July 21 and 22, attackers served up a fake Claude Desktop.exe through Bing search ads. The trojanized installer downloaded roughly 7,100 times before Anthropic removed it and installed SectopRAT, a .NET remote-access trojan designed to collect browser credentials, payment cards, cookies, and files.
The weirder part: poisoned SKILL.md files. SKILL.md is a configuration file used by Claude's agent skills system. Attackers are hiding malicious instructions inside these files disguised as style-guide notes. When Claude loads a tainted SKILL.md, hidden commands silently re-download the infostealer. If someone wipes their machine thinking they've cleaned it, but reintroduces the poisoned SKILL.md file, say, from cloud sync or a shared project repository, the malware installs itself again. It's malware persistence baked into the target's own workflow.
This is worth thinking about because it's not a Claude vulnerability. Anthropic made clear: no evidence the malware was installed via Claude or connected to anything inside the service. The company is a target because it's valuable. People with paid Claude subscriptions have payment methods on file. Usage credits have immediate monetary value. Infostealer malware is endemic and promiscuous, it steals from every application on the machine. Claude just happens to be sitting on a PC someone already compromised.
The SKILL.md angle reveals something about how agent systems will be attacked as they proliferate. When the application itself is a tool for automation and configuration, the attack surface widens. A poisoned config file isn't just a config problem anymore. It becomes a persistent backdoor because the AI agent is designed to read and execute instructions from files.
Anthropic can invalidate sessions and refund charges. They can't disinfect customer machines. That's on the user and whatever endpoint security they're running. For now, the advice is standard: if your usage limits look like they refilled and then drained while you weren't using Claude, you were probably one of thousands of people whose session got stolen.
This will happen again, to Claude and every other paid AI service. It's not news that malware exists. It's not even news that infostealers target subscription services. What's interesting is watching the attack patterns evolve as AI agents become the vehicle for configuration, workflows, and automation. When your AI application reads SKILL.md files and executes them, a poisoned SKILL.md file is no longer just a data problem.
