Infostealer Malware Targets Claude AI Accounts via Session Hijacking
Attackers are bypassing multi-factor authentication by stealing active session tokens to access private AI conversations.
Cybercriminals are deploying specialized infostealer malware to target Claude AI users, aiming to hijack active login sessions. This technique allows attackers to bypass traditional security hurdles to gain unauthorized access to private accounts.
According to reports from PYMNTS and verified cybersecurity data, the malware specifically targets session tokens rather than user passwords. By capturing these tokens, hackers can effectively clone a user's authenticated state, allowing them to enter an account without needing to provide a password or trigger multi-factor authentication (MFA) prompts. Once inside, attackers can access a user's full conversation history and any sensitive data stored within the AI's interface.
The Rise of Session Hijacking
This attack reflects a broader trend in cybercrime known as session hijacking or cookie theft. While traditional phishing attempts focus on stealing credentials, session theft targets the "cookie" that tells a website a user has already logged in. Because the server believes the attacker is the already-verified user, these intrusions are significantly harder to detect through standard login alerts or security notifications that typically trigger during a fresh sign-in attempt.
Risks to Intellectual Property
The shift toward targeting AI platforms highlights the increasing value of Large Language Model (LLM) accounts. As professionals and corporations increasingly use Claude to process proprietary code, strategic plans, and personal data, these accounts have become high-value targets. A compromised session provides a direct window into a user's intellectual property and organizational secrets, turning a productivity tool into a potential data leak point.
Future Outlook
Security experts continue to monitor the evolution of infostealer campaigns as they pivot toward SaaS and AI ecosystems. While the current wave focuses on session tokens, the industry is watching for more sophisticated methods of persistence within AI accounts. Users are encouraged to maintain updated security software and remain vigilant about the software they install on their local machines to prevent the initial infection of infostealer malware.