Info-Stealers Target Claude Accounts to Siphon Quotas via Unauthorized Tokens

On September 9, TechCrunch reported that multiple Claude users recently noticed their account quotas were being rapidly consumed even though they were not actively using the service. Following an investigation, Anthropic stated that hackers used stolen Claude login sessions to access user accounts and drain their usage quotas.

On August 4, Grant Desveaux, an independent AI consultant from East Sussex, UK, noticed anomalies with his Claude Max 20x account. He had not worked that day, yet his account usage continued to climb.

The next day, Desveaux disconnected all tools integrated with Claude and paused his scheduled tasks and cloud execution functions, but his usage still jumped from 45% to 55%. He stated that no local Claude Code tasks were running at the time either.

Desveaux then contacted Anthropic, requesting detailed usage logs. Anthropic did not provide an itemized breakdown, but acknowledged the account anomaly, suspended his paid account, logged out all active sessions, revoked server-side Claude Code tokens, and refunded him £44.49 for the remainder of his subscription. A Claude Max 20x subscription costs $200 per month.

The account suspension directly impacted Desveaux's work. He primarily assists small and medium-sized enterprises in deploying AI agents, such as automatically extracting purchase order details from emails and entering the data into accounting software. As a sole proprietor, he also relies heavily on AI tools for his daily administrative tasks, website design, and programming work.

Following its investigation, Anthropic informed Desveaux that a compromised Claude session key had been used to generate an unauthorized Claude Code OAuth token. The company discovered that his account appeared to be utilized by a suspicious third-party service to process tasks for other users, though it could not determine how the attackers gained access in the first place.

This means that once attackers obtain account access, they can consume a user's quota without their knowledge. TechCrunch noted that Anthropic's customer support system can only view aggregate usage and cannot provide itemized usage logs to users, meaning such unauthorized consumption could persist for months undetected.

Desveaux subsequently shared his experience on Reddit, discovering that multiple other users had encountered similar issues. One user reported that their account had been upgraded without authorization, their credit card was charged, and usage surged from 0% to 100% without any activity on their part. Another user stated that after sending just a few prompts and performing a single web search, their account usage spiked from 0% to 49% within 12 minutes.

Another user reported that their daily quota was depleted for three consecutive days without any usage, prompting them to open an issue report on GitHub. Subsequently, multiple users commented on the issue describing similar experiences.

Some users shared security alert emails sent by Anthropic. In these emails, Anthropic stated that the company had recently discovered attackers using common info-stealing malware to compromise Claude login sessions from users' computers, which were then used to access Claude accounts and exhaust quotas.

Info-stealing malware typically targets passwords, session data, and login credentials stored on a computer. Anthropic stated that upon detecting suspicious activity, the company forces user logouts, revokes existing authorizations, issues refunds in certain cases, and advises users to check their devices for malware infections.

Anthropic also emphasized that this malware is not distributed by Claude itself. Users likely contract the infection by downloading compromised software or clicking malicious advertisements.

However, Desveaux did not receive the aforementioned security alert. He stated that he found no evidence of an intrusion on his computer and still cannot determine how the attackers acquired access to his account.

About two weeks later, Desveaux's Claude account was restored. However, frustrated by the sluggish response time and Anthropic's inability to provide detailed usage logs, he ultimately canceled his subscription and switched to Cursor, which supports multiple models.

Desveaux believes Anthropic still lacks adequate tools to help users identify the source of quota consumption. When asked by TechCrunch how users can determine if their accounts are being abused, Anthropic declined to comment.