Anthropic Users Hit by Infostealer Attacks, Session Thefts

A threat actor used a variety of infostealers to collect session information and access Claude accounts belonging to an unknown number of users.

The current story record is based on Dark Reading; additional corroboration will be attached if the pipeline finds it.

No active exploitation was identified in the current reporting reviewed.

The article describes active malicious behavior rather than a theoretical weakness. The value for defenders comes from understanding who or what was targeted, how access was obtained, which tools or techniques were used and what outcome the attackers achieved.

Map the reported attack behaviors to telemetry available in your environment.