Executive Summary
Anthropic’s Claude AI platform is the target of two sophisticated attack chains designed to steal authenticated session cookies and compromise paid accounts. The first involves a variety of Windows and macOS infostealers—including Vidar, Lumma, and Atomic Stealer—that exfiltrate browser cookies to bypass two-factor authentication and single sign-on. This allows attackers to hijack active sessions and drain paid usage limits.
A second campaign, tracked as FakeAgent, utilized malicious sponsored ads on Bing to direct users to a compromised Claude Artifact hosted on the legitimate claude.ai domain. This campaign distributed SectopRAT via DLL sideloading and introduced a novel persistence mechanism using poisoned SKILL.md configuration files. These malicious files allow the threat to persist or re-download payloads even after a full operating system reinstall if the files are reintroduced to the Claude environment.