Hackers Are Stealing Claude Subscribers' AI Tokens — How to Stay Safe

Paid AI subscriptions have become a target for a new kind of theft. Security researchers and affected users report that infostealer malware is silently hijacking Claude accounts — stealing users' login sessions, minting unauthorized tokens, and draining paid allowances before the rightful owner notices anything. The same stolen-session technique also affects ChatGPT, Gemini, Cursor and a dozen other AI services, and it works even when multi-factor authentication is switched on.

What happened: Claude users watched their tokens drain

On August 4, 2026, Grant De Swardt, an independent AI consultant based in East Sussex, UK, noticed his Claude Max 20x account consuming tokens while he wasn't working. The next day he ran a controlled test — disabling all integrations, pausing scheduled tasks, and not touching Claude at all — and still watched his usage climb from 45% to 55%.

When he posted his experience on Reddit, other users reported the identical pattern. One described usage jumping "from 0% to 100% automatically without me even touching it." Another saw 0 to 49% consumption in just 12 minutes from minimal use. A third burned through their max tokens daily for three consecutive days without any personal usage, and filed a GitHub issue.

Anthropic eventually confirmed the cause: a "compromised Claude session key was used to mint unauthorized Claude Code OAuth tokens," and the affected accounts "appeared to have been used by an unauthorized-looking third-party service to handle activity for other people."

How the attack actually works

The key detail is that the malware did not come from using Claude itself. Anthropic explicitly told De Swardt the theft "didn't come from using Claude itself" — the software typically arrives through infected downloads, malicious ads, or bundled installs.

Here is the chain of events once infostealer malware lands on a machine:

• The malware harvests saved passwords, cookies, and session data from browsers and apps.
• Attackers package the stolen data into "stealer logs" and sell them on underground forums and Telegram channels.
• Buyers load the stolen session/localStorage data into anti-detect browsers such as Camoufox or SeleniumBase, and route traffic through proxies to avoid location-based security checks.
• Because the session already belongs to a logged-in user, the attacker is, in Okta threat-intel director Jeremy Kirk's words, "effectively logged in to an LLM service without actually logging in."

For Claude specifically, a stolen session key lets an attacker mint Claude Code OAuth tokens — granting the ability to run the victim's paid account like their own.

This is bigger than Claude: the 7 GB dump

Okta's threat intelligence team analyzed a 7 GB infostealer dump released on a Telegram channel on August 2, 2026. The dataset covered 5,871 infected machines across 162 countries. Inside it they found:

Services represented in the stolen logs include Google (Gemini), Anthropic (Claude), OpenAI (ChatGPT), Amazon, Groq, OpenRouter, Cursor, Poe.com, Character.ai, Pika, Gamma, and Notion. Okta also flagged that 17.7% of the tokens contained plaintext personal information — names, phone numbers, email addresses — which stays valid for phishing even after the tokens themselves expire.

Google's Threat Intelligence Group put it bluntly: "The cost of premium model access and high-performance compute is one of the primary barriers for threat actors seeking to operationalize AI." Stolen paid accounts remove that barrier.

The black market for AI accounts: "LLMjacking"

A whole underground economy has built up around stolen AI access. Telegram vendors advertise discounted access to Claude, Cursor, ChatGPT, and Gemini — with "24x7 support and money-back guarantees." One service called "Poison Claude" claims access to Anthropic's Opus 4.8, 4.7, 4.6, and Sonnet 4.6 models.

This practice has a name: LLMjacking. Attackers weaponize stolen keys or sessions for espionage, extortion, resource theft, or simply to rack up heavy compute bills on the victim's account. In one incident investigated by Mandiant, a threat actor gained cloud access through an exposed GitHub personal access token and deployed unauthorized AI infrastructure. Google says it has observed "more personas seeking to purchase AI-related accounts and more sellers advertising these accounts" across cybercrime communities.

Why MFA doesn't save you

This is the part that surprises most people. Switching on two-factor authentication — or even a hardware key — does not stop session-token theft, because the attacker isn't logging in with a password at all. They're replaying a session that was already authenticated.

As Jeremy Kirk explained: "Stronger authentication and the use of phishing-resistant technologies such as passkeys has made username-and-password takeovers harder, but it does not stop a stolen session token."

That is also why Anthropic couldn't quickly detect the abuse: it tracks total usage only, with no itemized logs showing what consumed your tokens. The company acknowledged the theft "could have gone on for months undetected." De Swardt was given a partial refund of £44.49 for the time remaining on his $200/month subscription, and his session was invalidated — but he still cancelled the subscription and moved to Cursor, saying he saw no way for users to fully protect themselves while usage transparency stays so poor.

What Anthropic did, and the gap that remains

When Anthropic detected the abuse, it took these steps:

• Signed affected users out and invalidated all active sessions and server-side Claude Code tokens.
• Issued partial refunds for unused subscription time.
• Suspended compromised accounts during the investigation.
• Sent warning emails to some users: "We have recently become aware of a bad actor that is using common infostealer malware to steal Claude login sessions."

The company declined to offer guidance on how users can spot misuse on their own, and it still does not provide itemized usage logs. That transparency gap is the reason a victim had to discover the theft by watching a percentage tick up on a dashboard.

How to protect yourself right now

Because the attack targets the device session, not just the password, your defence starts on the machine, not the login page:

• Keep infostealers off your device. Install software only from official stores and publisher sites, avoid pirated or "cracked" apps, and don't click through malicious ads. The malware usually arrives this way.
• Stop relying on a password alone. Use strong, unique passwords plus a password manager — but treat MFA as helpful, not sufficient, against session theft.
• Watch for unexpected usage. In Claude and ChatGPT, check your plan/token meter regularly. A sudden spike while you're idle is the main red flag.
• Scope and rotate API keys. Give keys the minimum permission and shortest lifespan you can, and rotate any that may have leaked.
• Use device-bound session protection where available. Google's Device Bound Session Credentials (DBSC) ties a session to a specific device in Chrome, so a stolen token is useless elsewhere.
• Lock down the network side. For teams, IP allowlisting stops session replay from unknown addresses.
• If you're affected: sign out everywhere, revoke active sessions, change your password, and contact the AI provider's support to request session invalidation.

The most important shift in mindset: your AI subscription is now a financial account worth protecting like a bank account — malformed traffic aside, someone draining your paid tokens costs you real money.

Frequently asked questions

Related articles

Comments