decrypted · 30 august 2026 · vulnerabilities and patching · supply chain · ai and llm security

The infostealer malware that doesn't need your password: Anthropic's Claude session theft

Anthropic told users this week that ordinary infostealer malware, the kind that has been quietly harvesting browser passwords for years, has started stealing something more useful: live Claude login sessions. Criminals used commodity tools, Vidar, LummaC2, StealC, RedLine and Acreed on Windows, and Atomic Stealer on Mac, to lift active session cookies from infected machines and reuse them to log into other people's Claude accounts, running up usage on someone else's bill without ever needing a password or a one-time code. Anthropic is revoking the stolen sessions, stripping saved payment methods and refunding unauthorised charges, and was careful to say the malware has nothing to do with Claude itself: it is generic credential-stealing software that happened to find a session token worth taking. That distinction is fair, but it does not make the lesson disappear, because the same trick works against any browser-based SaaS tool a UK team logs into, and most of the defences organisations have built sit at the wrong layer to stop it.

The keycard, not the lock

Password strength and multi-factor authentication protect the front door: the moment someone proves who they are. A stolen session cookie skips the door entirely. It is less like a stolen password and more like a stolen hotel keycard: whoever holds it walks straight into the room, because the hotel already checked identity when the card was issued and has no way of knowing the card changed hands. Infostealers do not bother guessing passwords or intercepting MFA codes any more, because there is an easier target sitting in every browser's cookie store: proof of a login that already happened. Once that proof is copied, it works from anywhere, on any machine, until it expires or someone notices.

The Secure by Design lesson

The fix is not "use a stronger password", because the password was never involved. It is to shorten how long that proof of login stays valid and useful outside its original context. The NCSC's own guidance on agentic AI, published this month, makes exactly this point for a related problem: avoid long-lived credentials, use temporary ones where possible, and revoke access as soon as a task is done. The same principle applies to ordinary human sessions, not just AI agents. UK organisations relying on browser-based tools, which by 2026 is effectively all of them, should treat session lifetime as a control worth setting deliberately: shorter timeouts, re-authentication for sensitive actions like changing payment details, and binding sessions to a device or IP range so a copied cookie stops working the moment it moves. None of that shows up on a compliance checklist about password policy, which is precisely why it gets skipped.

Also this week

ServiceNow patched three maximum-severity flaws in its AI Platform. CVE-2026-18885 and CVE-2026-18886 (code injection) and CVE-2026-74820 (SQL injection) all carry a CVSS score of 10.0 and require no authentication, meaning an attacker who can reach the instance can run code or arbitrary SQL against it with no login at all. ServiceNow disclosed the flaws on 27 August and says it has seen no evidence of exploitation against instances it hosts, but self-hosted customers must patch independently, and ServiceNow underpins case management and HR systems across UK councils, police forces and the NHS. A CVSS 10.0, unauthenticated, no-interaction bug in a platform holding that much sensitive UK public data is worth checking off the news page and onto this week's patch list.

Nineteen Chrome and Edge extensions were caught running a shared malware framework. Researchers at Socket found 16 distinct malicious modules built into the extensions, draining cryptocurrency wallets, phishing hardware-wallet seed phrases and stealing exchange and social media session tokens, the same session-theft trick as above, just via a browser add-on rather than a downloaded file. The largest, an "Enable Right Click" utility, had reached 80,000 users before its update turned malicious; five of the nineteen extensions were legitimate tools bought from their original developers specifically to weaponise their existing user base. Any UK organisation that lets staff install browser extensions freely is trusting every future update from every developer whose extension anyone has ever installed.

Sources

Rethinking how long a login should stay trusted for your own systems? Get in touch.

The infostealer malware that doesn't need your password: Anthropic's Claude session theft

The keycard, not the lock

The Secure by Design lesson

Also this week

Sources

More like this