Malware is hijacking Claude sessions and draining your API credits
Anthropic force-logged users out and wiped saved cards after infostealers lifted live sessions, bypassing 2FA. Here's how to spot it and lock down.
Copy markdown
The tell: usage refills, then drains while you're idle
Anthropic says the giveaway is limits that "refilled and then drained while you weren't using Claude." One subscriber's account jumped from 0% to 100% with no work done; another burned through max daily limits for three straight idle days. Open your usage view and look for jumps you can't explain.
How they get in: stolen session cookies, not passwords
The malware copies your authenticated browser session, so it walks straight past your password and 2FA. Anthropic named Vidar, LummaC2, StealC, RedLine and Acreed on Windows, plus Atomic Stealer (AMOS) on Mac — usually picked up from pirated downloads and sketchy apps, not from Claude itself.
What Anthropic already did to your account
It force-signed affected users out, revoked compromised sessions and server-side tokens, removed saved payment methods, and refunded charges it could identify. If you were logged out unexpectedly or lost a saved card, this is likely why.
Do this now: rotate, revoke, de-worm
Signing out does not remove the malware — it will just re-steal your next session. Change your credentials, revoke all other active sessions, rotate any API keys stored on that machine, and actually clean the infostealer off before you log back in.
The blind spot: no itemized usage
Anthropic tracks only total usage, not a per-call breakdown, so drained credits stay nearly invisible until your quota is gone. Until that changes, you are the monitoring — watch for unexplained spikes yourself, because no dashboard will flag them for you.