Hackers steal Claude tokens using infostealer malware
anthropic's claude users report unauthorized token usage, hackers use malware to steal login sessions, affecting accounts and subscriptions.
grant de swardt, an independent ai consultant, noticed unusual token usage on his claude max 20x account, despite not using it. he contacted anthropic, which suspended his account, invalidated sessions, and issued a partial refund. anthropic found that a compromised claude session key was used to mint unauthorized claude code oauth tokens. the company warned users about infostealer malware stealing claude login sessions, allowing hackers to access accounts and consume tokens. users reported similar experiences on reddit and github.