Malware Is Stealing Claude Logins, and the Warning Sign Is Your Usage Draining Overnight
Anthropic emailed affected users after common infostealer malware copied their Claude login sessions and let attackers burn through usage limits. The malware has nothing to do with Claude, which is exactly what makes it worth understanding.
Anthropic has emailed a group of Claude users with an unwelcome message: malware on their own computers copied their Claude login sessions, and somebody else has been using their accounts. The company signed the affected sessions out, removed saved payment methods so nothing could be charged, and refunded charges it identified as unauthorized. The tell that something was wrong, according to the notice, is oddly specific: usage limits that looked like they refilled and then drained while the account owner was not using Claude at all.
The malware families named are Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer, known as AMOS, on a smaller number of Macs. These are ordinary infostealers, the workhorses of low-end cybercrime. They usually arrive through pirated software, cracked game installers, or apps downloaded from somewhere that is not the official source. Once running, they quietly copy saved passwords, browser cookies, and credentials belonging to other local applications, then send the pile off to whoever deployed them. Anthropic’s position is that this has nothing to do with Claude itself: the malware is general purpose, it was not installed through Claude, and it was not caused by anything users did with Claude. Somebody simply went through the harvested data afterwards, picked out the Claude sessions, and used them.
Why a stolen cookie beats a strong password. This is the part worth understanding even if you never touch Claude. When you log into a website, the site hands your browser a session cookie, a small token that says “this person already proved who they are.” Every page load afterwards shows that token instead of your password. Copy the token, paste it into another browser, and you are inside the account without ever seeing the login screen, which also means without a password prompt and without two-factor authentication. Your password could be forty random characters and it would not help. That is why infostealers are so effective and so boring at the same time: they do not break the lock, they photocopy the key you are already carrying.
What this means for you. For most people: nothing to do, and no reason to panic about Claude specifically. If you did get one of these emails, the order of operations matters. Clean the machine first with a proper scan, then change your passwords, then re-add a payment method. Doing it in the other order just hands the attacker fresh credentials. More generally, treat this as the reminder it is. The riskiest thing on your computer is usually not the AI tool you use, it is the free installer you downloaded to avoid paying for something. And if you use any AI service with a usage quota, that quota is now a burglar alarm. Limits that empty while you sleep are a symptom, not a billing glitch.
Sources
Source: https://www.securityweek.com/anthropic-warns-claude-users-of-infostealer-malware-infections/
DeepSeek Opens Up a 305 Billion Parameter Model That Can Finally See
DeepSeek-V4-Flash-Vision-Exp went up on Hugging Face under an MIT license: the first V4 family model that handles images, with big jumps on multimodal agent benchmarks and text performance that holds steady.
