Malware steals Claude subscribers' tokens without the developer noticing

A wave of Claude accounts has been compromised by malware that hijacks login sessions and consumes subscribers' paid tokens, often without the person even having opened the app that day. The case, compiled by TechCrunch and reported by Startups, a Brazilian tech news outlet, has already resulted in account suspensions, partial refunds, and at least one subscription cancellation. Anthropic confirmed the problem, but admits it still doesn't offer a tool that lets subscribers track on their own what's consuming their quota.

For those building software in Brazil who have already put Claude Code into their workflow, the message is direct: the attack vector isn't the AI itself, it's the developer's machine. And the consequence isn't just an improper charge, it's an account suspension that can bring down an entire freelancer's or small team's operation.

How the attack works

The culprit is an infostealer, a category of malware that installs itself on the victim's computer and combs through passwords saved in the browser, cookies, session data, and login credentials. It's nothing new in security, what changes is the target: these stealers are now harvesting active Claude sessions.

The critical point is that the attacker doesn't need your password. With the session token or authentication cookie in hand, they reuse an already authenticated session, which usually gets around MFA too, because the second-factor barrier was already cleared when you logged in. From there, it's possible to issue Claude Code OAuth tokens on the victim's behalf and run workloads against their quota.

In the most detailed case, that of Grant De Swardt, an AI consultant in the UK and subscriber to the Claude Max 20x plan, Anthropic concluded after investigating that a compromised session key had been used to issue unauthorized Claude Code OAuth tokens. According to the account the company sent him, the account "appeared to have been used by an unauthorized-looking third-party service to process other people's activity," in other words, the victim's paid quota had become someone else's infrastructure.

The symptom: usage that climbs on its own

The pattern that shows up in the reports is the same: the usage meter climbs without matching work. De Swardt noticed on August 4th that consumption kept rising even though he hadn't worked that day. The next day he disabled everything connected to the tool, and the number kept climbing.

"In the most controlled window, it went from 45% to 55% while I was doing no work at all, Cowork's scheduled tasks were paused or completed, cloud execution via Dispatch was disabled, and there was no active local Claude Code task running that would account for it."

-- Grant De Swardt, to TechCrunch

After posting about the case on Reddit and getting around 80 comments, he found out he wasn't alone. The reports converge on the same symptom, at different speeds:

| Report | Symptom | |---|---| | User 1 | Plan upgraded without consent, card charged, usage went from 0% to 100% without touching the account | | User 2 | Consumption went from 0% to 49% in 12 minutes, having used only a few prompts and one web search | | User 3 | Maximum token limit exhausted for three days straight with no usage of their own; opened a GitHub issue |

Two of these users published emails from Anthropic acknowledging the problem: "We recently became aware of a malicious actor using common infostealer malware to steal Claude login sessions from users' computers, and then using those sessions to access Claude accounts and consume their usage."

What Anthropic did, and what it didn't

When it identified suspicious activity, Anthropic logged users out, invalidated existing authorizations, issued some refunds, and warned about the possibility of malware on the machine. In De Swardt's case, the company suspended the paid account, invalidated all associated Claude Code sessions and server-side tokens, and issued a partial refund of £44.49 on the US$200 per month subscription.

The company also made clear that the malware did not originate from using Claude itself, and can be picked up from different sources: downloads of infected software, clicks on malicious ads, and the like.

The gap is in transparency. De Swardt asked for a detailed usage breakdown to identify what was burning through his quota, and Anthropic didn't provide it. Asked by TechCrunch how users can identify misuse, the company declined to comment. Without a usage breakdown, the subscriber is left in the dark: they can see that the quota got burned, but can't tell which session, which IP, or which token did it. De Swardt's account only came back after about two weeks, and the impact was real: as a freelancer, he depends on AI agents for nearly his entire operation, from administrative tasks to website design and coding. In the end, he cancelled Claude and switched to Cursor, which lets him switch between multiple models, including cheaper open-source options.

What changes for the Brazilian developer

The risk isn't abstract. Claude Code has become part of the routine for a lot of people writing software here, and the same machine that runs the agent is the one holding the session token. If it's compromised, the paid quota becomes a target, and a precautionary suspension can lock up your environment for weeks.

A few measures that make sense while there's no official usage-auditing tool:

• Log out and re-authenticate periodically. Invalidating old sessions shrinks the window in which a stolen token remains valid.
• Treat downloads and extensions as attack surface. Infostealers arrive through pirated software, fake installers, and malicious ads. Only download binaries from the official source.
• Monitor the usage meter as a security signal. Quota climbing without matching work is symptom number one. If it happens, revoke your sessions immediately.
• Review OAuth integrations and connected services. The attack issues Claude Code OAuth tokens; auditing what's authorized helps close doors.
• Run a malware scan on your workstation at the slightest sign of anomalous usage, since the compromise lives on the endpoint, not in Anthropic's cloud.

What remains unresolved is exactly the missing piece: Anthropic didn't explain how a third-party service gained access in De Swardt's investigation (he says he found no evidence of malware on his own machine), and it hasn't committed to a usage-breakdown tool. Until that changes, the developer paying for the quota is the one carrying the burden of watching their own consumption.