Security Market: Hackers steal Claude tokens from subscribers via infostealer malware

Anthropic Claude users are facing unauthorized token consumption, with hackers using info-stealer malware to steal active login sessions and bypass passwords and MFA. Independent AI consultant Grant De Swardt saw his Claude Max account consume tokens while idle, and despite disabling connected services, usage continued. Anthropic locked his account, reset sessions, and invalidated tokens issued to Claude Code. Other users reported similar issues, including unauthorized upgrades to paid tiers without consent. Anthropic confirmed the attacker method and advised users to terminate sessions, change passwords, enable MFA, scan for malware, review payment details, and document unusual usage. However, without detailed usage reports, detecting abuse is difficult. The incident highlights growing security and trust concerns for AI subscription services, prompting some users to consider alternatives like Cursor.