Hackers Are Stealing Claude Tokens From Subscribers: What Happened and How to Protect Yourself

If you pay for Claude and noticed your usage draining on its own, you were not imagining it. Hackers have been stealing active Claude sessions and burning through subscribers’ token limits, and Anthropic has now confirmed the attack.

This broke publicly in early September 2026 when TechCrunch reported on the experience of Grant De Swardt, an independent AI consultant in East Sussex, UK. His Claude Max 20x account was burning tokens on August 4, 2026, even though he had not opened the app. The next day he disabled every connected service and still watched usage climb from 45% to 55%. He contacted Anthropic, got his account suspended instead of explained, and lost nearly two weeks of access before it was reinstated.

He was not the only one. His Reddit post drew over 80 comments within days. Others reported accounts auto-upgraded without consent, credit cards charged without authorization, and usage hitting 100% within hours of a fresh billing cycle.

---

What Actually Happened

Anthropic eventually sent warning emails to some affected users. The language was direct. The company said it had become aware of a bad actor using common infostealer malware to steal Claude login sessions from users’ computers, then using those sessions to access Claude accounts and burn through their usage.

Here’s the thing about session theft: it bypasses your password entirely. When you log into Claude, your browser stores a session cookie that proves you are already authenticated. Infostealer malware grabs that cookie off your machine. The attacker then imports it into their own browser and walks straight in, no password needed, no 2FA prompt triggered. From Claude’s perspective, it looks like you.

Anthropic identified six specific malware families involved in this campaign:

• Vidar (Windows) — a long-running stealer sold as malware-as-a-service
• Lumma / LummaC2 (Windows) — among the most widespread credential stealers of 2025 and 2026
• StealC (Windows) — built specifically to target cookies and browser credentials
• RedLine (Windows) — one of the most frequently seen names in credential breach archives
• Acreed (Windows) — a newer family, currently on the rise
• Atomic Stealer / AMOS (macOS) — proof that Mac users are not immune

Anthropic was clear that this malware did not come from Claude itself. Most victims were likely infected through pirated software, malicious ads, or unofficial downloads months before the Claude-specific theft happened. The attacker collected a huge pool of stolen sessions and then started picking through them for Claude accounts specifically.

---

A Separate Attack Route: The MCP Token Hijack

The infostealer campaign was not the only Claude security problem this year. In May 2026, researchers at Mitiga Labs published a technically distinct attack targeting Claude Code users specifically, which is worth understanding even if you only use the web interface.

Claude Code connects to external services through a system called MCP (Model Context Protocol). OAuth tokens that grant access to those services are stored in a plain-text configuration file at ~/.claude.json on your machine. Mitiga found that a malicious npm package with a post-install hook could silently modify that file, redirect all MCP traffic through an attacker-controlled server, and intercept those tokens before they reach their legitimate destination.

What made it genuinely alarming was the persistence. If you rotated the OAuth token, the hook wrote it back. If you corrected the MCP URL, the hook restored the malicious one on the next load. The attacker got a durable man-in-the-middle position with automatic recovery, invisible to the user and indistinguishable from normal traffic on the service provider’s side.

Mitiga reported the issue to Anthropic on April 10, 2026. Anthropic replied on April 12 that it was out of scope, on the basis that the user had already consented to installing software. No patch was released. Developers using Claude Code with MCP integrations are still exposed to this vector today.

---

What Anthropic Did (And Didn’t Do)

For the infostealer campaign, Anthropic’s response was reasonable given the constraints. The company detected suspicious activity, signed affected users out to invalidate stolen sessions, removed saved payment methods to block further charges, and issued partial refunds where it could identify unauthorized use. It notified affected users by email and named the specific malware families, which is more than most platforms do.

What it did not do was provide itemized token usage. De Swardt specifically asked for a breakdown of what was consuming his tokens. Anthropic does not offer this. That gap meant the theft could have run undetected for much longer on accounts that were not watching their dashboard closely. It also meant that some users whose usage patterns were unusual but not dramatic enough to flag algorithmically were never contacted at all.

For the MCP hijacking vulnerability, Anthropic declined to patch it. The “user consent” reasoning is technically defensible but practically unsatisfying for developers who cannot realistically audit every npm package their projects touch.

---

How to Tell If Your Account Has Been Compromised

The clearest signal is usage that does not match your activity. Watch for:

• Token limits that appear to refill and then drain at hours when you were not using Claude
• Usage climbing steadily even after you pause or disable integrations
• An email from Anthropic signing you out and removing your saved payment method
• Unexpected charges on the card attached to your Claude account
• A “usage at X%” message that does not match what you remember doing

De Swardt’s tell was clean: a 10-percentage-point jump across a controlled window with no active tasks running. Most people will not catch it that precisely, which is exactly what makes this kind of theft effective.

---

Step-by-Step: What to Do Right Now

If you are a Claude subscriber, these steps take about 10 minutes and are worth doing regardless of whether you have seen any suspicious activity.

1. Log out of all Claude sessions. Go to your Claude account settings and sign out all active sessions, not just the current one. This invalidates any session cookies currently in circulation. If a thief has your cookie, forcing a full sign-out means theirs stops working.
2. Change your Claude password. Session theft bypasses passwords, but changing it ensures a clean credential state for future sessions, and helps if the attacker also has your login details from a credential database.
3. Check your usage dashboard. Log back in and review your current token consumption. Screenshot it if anything looks off so you have a reference point to compare over the next 48 hours.
4. Remove and re-add your payment method. Delete the card currently saved on your Claude account. This is what Anthropic does for affected users proactively. Re-add it after you have confirmed your device is clean.
5. Scan your computer for infostealer malware. Use a dedicated tool rather than your standard antivirus. Malwarebytes detects most of the families Anthropic named, including LummaC2, StealC, and Atomic Stealer. Run a full scan, not a quick one.
6. Check what you have downloaded recently. Infostealers most commonly arrive through cracked software, unofficial game downloads, and malicious browser extensions. If anything in your recent download history looks questionable, remove it and trace whether it matches the infection window.
7. If you use Claude Code with MCP integrations, audit your ~/.claude.json file. Open the file and check whether the MCP server URLs listed are the ones you set intentionally. If you see an unfamiliar proxy URL, your configuration may have been modified. Restore the correct URL and review which npm packages were recently installed on that machine.
8. Enable notifications for account activity. Claude does not currently offer granular session alerts, but you can monitor your email closely for any sign-in notifications or account change emails from Anthropic. Set your account email to high-priority filtering so nothing slips through.

---

For Claude Code Users: Extra Steps

The MCP hijacking attack requires a specific setup to execute, but if you use Claude Code with any OAuth-connected services, the risk is real and Anthropic has not addressed it at the infrastructure level.

• Audit every npm package installed on machines where Claude Code runs. Pay particular attention to packages installed in the last 90 days and anything with post-install scripts.
• Watch for unexpected changes to your ~/.claude.json file. Mitiga recommends monitoring Claude Code configuration changes and MCP server URL changes as part of standard endpoint security practice.
• If you see MCP traffic routed through an address you do not recognize, treat the session as compromised and rotate all OAuth tokens for connected services immediately, including Jira, GitHub, Confluence, and any database connections.
• Be cautious about any new npm packages that arrive as dependencies rather than direct installs. The attack vector relies on a malicious post-install hook running automatically during a routine install.

---

The Bigger Issue Nobody Is Talking About

Here’s what this situation actually tells you about where AI subscriptions are heading. A Claude Max subscription costs $200 per month. When tokens at that level represent real money, they become worth stealing. We are going to see more of this, not less, as premium AI subscriptions get more expensive and usage allowances get tighter.

The problem is compounded by the fact that current Claude accounts offer no itemized usage log. You can see a percentage consumed, but not which session, which task, or which integration consumed what. That is a significant blind spot for any power user running agents, automations, or multiple integrations. If a thief is burning 10% of your daily allowance and you are routinely hitting 80% on your own, you may never notice.

For context, the same class of malware now targeting Claude sessions has been hitting crypto wallets and banking credentials for years. The Malwarebytes write-up on this incident treats it as a natural extension of a well-established credential theft market. LummaC2 alone was one of the most prevalent stealer families of 2025 and has continued into 2026. These are not amateur operations.

What is new is that your AI account is now in scope. Treat it accordingly.

---

Anthropic’s Honest Limitations Here

It would be easy to write this as a takedown of Anthropic’s security posture, but the picture is more complicated. The infostealer campaign exploited malware already present on users’ machines, not a vulnerability in Claude’s infrastructure. Anthropic’s systems detected the anomalous activity, invalidated stolen sessions, and warned users. That is a reasonable incident response for an attack vector that sits largely outside the company’s control.

The MCP hijacking issue is harder to defend. Researchers notified Anthropic, Anthropic acknowledged the report, and Anthropic decided not to fix it. That decision may be technically justifiable, but it leaves Claude Code developers with a real exposure and no remediation from the vendor. That is worth knowing if you are deciding how much to invest in Claude’s ecosystem.

The token visibility gap is probably the most solvable problem here. A usage log that shows session-level detail, or at least flags activity from IP addresses that have not been seen on the account before, would make this class of theft significantly harder to sustain. Whether that makes the roadmap is another question.

---

If you use Claude regularly and have automated agents or integrations running in the background, your usage dashboard is worth checking today, not next billing cycle.

---

Sources

1. TechCrunch: Hackers are stealing Claude tokens from subscribers (Julie Bort, September 8, 2026)
2. BleepingComputer: Anthropic warns infostealer malware is hijacking Claude sessions to drain usage (Mayank Parmar, August 30, 2026)
3. SecurityWeek: Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking (Kevin Townsend, May 7, 2026)
4. Malwarebytes: Infostealers are hijacking Claude accounts at users’ expense (September 1, 2026)
5. Security Affairs: Infostealers Are Hijacking Claude Sessions and Draining Subscriptions (Pierluigi Paganini, August 31, 2026)
6. eSecurity Planet: Anthropic Warning: Infostealer Malware Is Hijacking Claude Sessions, Draining Accounts (August 31, 2026)
7. Reddit r/ClaudeAI: Max 20x usage went from 0 to 100 in half an hour (Grant De Swardt, August 2026)