Wiz Research's analysis of NordStellar data found that three infostealer families — Lumma C2, RedLine, and Vidar — account for 85.7% of all detected incidents, with AWS and GCP making up 46% and 13% o…
Anthropic confirmed that hackers using infostealer malware have been hijacking Claude subscribers' login sessions and draining their paid usage without stealing passwords, affecting users like indepen…
Lunar, a security platform, has developed a method to parse and verify exposed non-human identities (NHIs) such as API keys, cloud tokens, and payment secrets from infostealer logs, which often contai…
Anthropic has detected a wave of infostealer malware campaigns that hijack Claude user accounts to mine AI tokens, and has begun signing affected users out and removing saved payment methods to stop t…
Anthropic began contacting affected Claude users on August 30, 2026, after discovering that infostealer malware had compromised their computers and stolen active login session cookies, allowing attack…
Anthropic has begun locking users out of their Claude accounts after login sessions were hijacked by infostealer malware, including Vidar, Lumma (LummaC2), StealC, RedLine, Acreed on Windows, and Atom…
Anthropic has begun signing out users and removing payment methods after detecting that infostealer malware, including Vidar, Lumma (LummaC2), StealC, RedLine, Acreed, and Atomic Stealer (AMOS), has b…
Darktrace investigated a July 2026 intrusion in which a user at an EMEA customer downloaded a fake Google Gemini installer that delivered the Vidar information stealer. The lure used a Google Colab pa…
Darktrace researchers reported that a fake Google Gemini installer delivered the Vidar infostealer on a company network in the EMEA region, with the malicious file hosted on Google Colab. The attack l…
Cybersecurity researchers identified a malicious npm package named "mouse5212-super-formatter" designed to upload files from the "/mnt/user-data" directory used by Anthropic's Claude AI assistant. SOC…