News
Infostealers Are Mass-Harvesting Login Credentials From Claude, Cursor and Codex
Gen Digital researchers have uncovered a wave of malware targeting AI coding agents, and Anthropic has confirmed real cases of hijacked Claude accounts and stolen paid usage quotas.
Contents
Popular AI-powered developer tools have become the newest target for malware authors. Threat researchers at Gen Digital have documented more than a dozen infostealer families that have expanded in recent months to target Claude, Cursor, Codex, Cline, Continue, OpenCode, Gemini and Kilo, stealing access tokens, login sessions and users' chat histories.
A Growing Malware Family
According to Gen Digital, the list of active families keeps growing week by week. Amatera targets Cline and Continue data on Windows. Remus, a variant of the well-known Lumma Stealer, attacks Claude, Cursor and OpenCode. CallbackBeaver recently expanded its reach to include Claude and Cursor, while BeeStealer, STG Stealer, HydraStealer, APEX Stealer and Otter Stealer also harvest data from coding agents' local configuration files.
On macOS, researchers described Djinn Stealer, which scans drives for Claude, Codex, Gemini, Cline, OpenCode and Kilo data. The scale of the phenomenon suggests malware authors now view AI agents as a target just as attractive as browsers or password managers.
How Session Theft Works
Infostealers bypass passwords and multi-factor authentication by stealing active browser sessions and cookies instead of login credentials themselves. From an infected computer, criminals obtain access tokens, refresh tokens, account identifiers, subscription information, conversation databases, command history, lists of recently opened files, project names and configuration artifacts.
Chat history with a coding agent carries extra risk, since developers routinely paste logs, code snippets, internal server names or API keys into it while debugging. Hijacking such a session can therefore mean a leak of company data, not just access to the tool itself.
A British Consultant's Case
Grant De Swardt, an independent AI consultant from East Sussex, UK, who pays $200 a month for a Claude subscription, described a concrete impact of the attacks. On August 4, 2026, he noticed sudden spikes in his token quota usage, in one case a jump from 45 to 55 percent, in another from zero to 100 percent within 12 minutes. His Reddit post drew 80 comments from other users reporting similar cases.
I don't think there's anything these people can do to protect themselves - Grant De Swardt, AI consultant
Anthropic's Response and the Scale of the Problem
Anthropic confirmed the issue in an official statement, suspended some accounts, invalidated hijacked sessions and issued partial refunds to some affected users, including 44.49 pounds to De Swardt. The company declined, however, to say how users themselves can recognize that their account has been compromised.
We recently learned of an actor using a popular infostealer-type malware to steal Claude login sessions from users' computers, and then using those sessions to access Claude accounts - Anthropic statement
The scale isn't limited to individual subscribers. Incident response firm Huntress confirmed that in a single campaign targeting Claude users, at least 29 organizations were compromised within just two days.
For Polish development teams increasingly relying on Claude Code, Cursor or Codex in their daily work, this means treating these tools like any other channel of access to company resources. Basic hygiene, keeping antivirus software up to date, logging out unused sessions and limiting the amount of sensitive data pasted into an agent, is becoming as important a security practice as securing a code repository.
