Infostealers Are Stealing Your Claude and ChatGPT Logins

If you run your business on Claude or ChatGPT, here is the short version: attackers no longer need your password to get into your AI accounts. They steal the session token your browser already holds after you log in, and that token walks them straight past your password and your two-factor code. Anthropic just warned that infostealer malware is doing exactly this to Claude accounts, quietly draining paid usage and, worse, reading whatever you have typed into those chats.

The fix is not complicated, but it is specific. You clean the machine that got infected, kill the stolen sessions, and change the habits that let a token leak in the first place. Below is how session theft actually works, how to spot it, and how to stop a hijacked AI login from bleeding into the accounts that really matter — your hosting panel and your email.

The reason to care goes beyond a wasted subscription. Your AI chat history is a diary of your business: draft contracts, customer names, API keys you pasted "just to test something", server details. A hijacked session hands all of that to a stranger.

How infostealer session-token theft actually works

Session theft skips your password entirely by stealing the cookie your browser stores after you log in. When you sign into Claude or ChatGPT and tick "keep me logged in", the site drops a session token in your browser so you do not have to re-authenticate every few minutes. Infostealer malware — things like RedLine, Lumma, or Vidar — scoops those tokens straight out of the browser's local files and ships them to the attacker.

Where does that token actually live? On Chrome for Windows it sits in an SQLite file at %LocalAppData%\Google\Chrome\User Data\Default\Network\Cookies, and on a Mac under ~/Library/Application Support/Google/Chrome. The values are encrypted, but they are encrypted with a key stored on the same machine — so any code running as you can decrypt them. That is the whole game. This is also why a clean device beats a strong password: the scan is protecting that cookie file, not your login form.

Here is the part that catches people out: that token already represents a fully authenticated session. The attacker imports it into their own browser and they are you. No password prompt. No two-factor code, because 2FA happens at login and this session is already past login. Your strong password did its job and it did not matter.

The malware usually arrives the boring way — a cracked app, a fake browser extension, a "download our tool" link, a malicious npm or pip package, or a rigged PDF. It runs once, grabs every token in Chrome, Edge, Firefox and Brave, and often deletes itself. You feel nothing. The first sign is usually your AI usage quota vanishing days later.

How to spot a hijacked AI session

The clearest warning sign is account activity you did not create: usage you cannot account for, or logins from places you have never been. Both Claude and ChatGPT let you check, and the paths are worth knowing before you need them.

• Check active sessions directly. In ChatGPT, open Settings → Security → Log out of all devices. In Claude, open Settings → Privacy (or Account) and use the log-out-everywhere control. Both invalidate every token currently in circulation — including the attacker's.
• Sudden quota drain. Your message limit or API credits fall faster than your own use explains. On paid plans this is often the first red flag.
• Unfamiliar sessions or devices. Look for active sessions or connected devices you don't recognise. If one appears, don't just remove it — assume the token came from your machine.
• Login alerts from odd locations. A sign-in from another country you can't explain is a strong tell. Search your inbox for "new login" or "security alert" from Anthropic and OpenAI.
• Chat history you don't recognise, or conversations that vanished. Attackers sometimes probe your history or clear it. A reordered or missing conversation list is a quiet warning.
• API usage from a region or time you never work. On the OpenAI or Anthropic usage dashboard, spikes at 3am or from an API key you forgot you made are a giveaway.

If you spot any of these, assume the machine you normally log in from is infected. Killing the session alone is not enough — a live infostealer will just grab the next token the moment you sign back in.

Lock down your AI logins in the next 30 minutes

Do these steps in order, because the sequence matters: clean the device first, then revoke sessions, then rotate secrets. Reversing that order lets the malware re-steal everything you just reset.

• 1. Scan the device. Run a full scan with Microsoft Defender or Malwarebytes on the computer you use for AI work. On Windows you can kick off a full Defender scan from an admin terminal with Start-MpScan -ScanType FullScan in PowerShell. If anything is found, treat every credential on that machine as burned.
• 2. Log out everywhere. In Claude and ChatGPT settings, revoke all active sessions and connected devices. This invalidates any stolen token.
• 3. Change the password and re-enrol 2FA. A new password forces a fresh login and, on most platforms, mints a new session secret. Re-enrolling 2FA also drops any device the attacker may have registered.
• 4. Rotate any API keys. If you generated Anthropic or OpenAI API keys, delete the old ones and issue new ones. Stolen keys are billed to you, and they don't expire on their own.
• 5. Audit browser extensions. Remove anything you did not deliberately install. Extensions are a common infection route and can read your tokens directly. While you're there, clear cookies for your AI sites so any lingering local token is gone.
• 6. Don't paste secrets into chats. Stop pasting live API keys, passwords or customer data into prompts. If a session leaks, that content leaks with it.

One habit worth building: use a dedicated browser profile for your business logins, separate from casual browsing and downloads. It keeps the token store for your important accounts away from the riskier corners of the web. If you want to go a step further, run downloads and unknown tools inside a throwaway VM or a separate low-privilege account — the infostealer can only reach the cookie files of the user it runs as.

Stop a hijacked AI account from spreading

The real danger is lateral movement: a stolen AI session becomes the crowbar for your hosting, your email and your customer data. Attackers read your chat history for clues, and business users leave plenty — server IPs, database names, the email you use for password resets, sometimes credentials pasted in plain text.

Break the chain before it starts:

• Never reuse the AI account password anywhere else. If it leaks, it should unlock exactly one thing.
• Put 2FA on the accounts that matter most — email first, then your hosting control panel, then your domain registrar. Email is the master key; whoever controls it can reset the rest.
• Use app-specific or scoped tokens for hosting. If your control panel offers API tokens with limited permissions, prefer those over your master login for automations.
• Assume anything in a leaked chat is public. Rotate any credential you ever pasted into an AI tool, even months ago.

This is where hosting choices quietly help. With TPC Hosting your data sits in the EU under GDPR, and if something looks wrong on your account there are real engineers on support 24/7 who can help you lock things down and check for unauthorised logins — not a ticket queue that answers next week.

What password managers and 2FA can and can't do

A password manager and 2FA are still worth every minute you spend on them — they just don't stop token theft on their own. They defend the front door; session theft climbs through a window that's already open. Understanding the gap tells you where to put your effort.

*Passkeys stop the phishing that leads to token theft, but once a session exists on an infected machine, the token can still be lifted. That's why the only real defence against infostealers is keeping the device clean and logging out of sessions you're not using. Turn off "keep me logged in" on shared or rarely-used machines, and sign out at the end of a work session on anything that isn't your locked-down personal device.

The uncomfortable truth: no login trick saves you if malware is running on your computer. Endpoint hygiene — patched OS, a real antivirus, no cracked software, careful with extensions — is the part that actually stops this attack. Everything else limits the blast radius.

Your one-page checklist

If you do nothing else this week, do these five things in this order.

• Scan the computer you use for AI work with a reputable antivirus.
• Log out of all sessions in Claude and ChatGPT, then change the password.
• Rotate any API keys tied to those accounts.
• Turn on 2FA for your email and hosting panel — email first.
• Stop pasting live secrets and customer data into prompts.

Run AI tools like they hold the keys to your business, because they now do. Treat a hijacked session the way you'd treat a break-in: clean up, change the locks, and check what else the intruder could reach.

FAQ