AI Summary

Infostealers replayed stolen Claude session cookies into paid accounts without accessing the login page or triggering two‑factor authentication. The compromised accounts were Anthropic’s card‑billed, self‑serve users, a group not governed by a corporate identity provider and lacking an admin console to sign out. Cookie replay bypasses SSO and 2FA, leaving only revocation and visibility as defenses. Anthropic notified affected users, identified six stealer families, signed the accounts out, removed saved payment methods, and refunded the charges discovered.

AI summaries can be wrong sometimes—always verify important details using the source article.