Anthropic recently began signing users out of Claude after discovering that commodity infostealer malware — running on the users’ own infected computers, not on Anthropic’s systems — had copied active Claude login sessions and used them to drain paid usage. The company confirmed it in a direct email, later reported by BleepingComputer, revoking the stolen sessions, stripping saved payment methods, and refunding confirmed unauthorized charges.
The mechanism is the interesting part, not the brand. Two-factor authentication protects the login moment. Once you’re in, the site hands your browser a session cookie so it doesn’t ask you to re-authenticate on every click. Infostealer malware copies that cookie, and an attacker who replays it looks — to the server — exactly like someone who already passed the password and 2FA checks. As Help Net Security put it, session theft has effectively become the new credential theft.
A stolen Claude subscription is a real but limited loss — a refund and an inconvenience. The same attack technique, aimed at a website’s admin login instead of a chatbot account, is a fundamentally bigger problem, and it’s one nearly every business with a website is exposed to right now.
The Scale of the Underlying Problem
The Claude incident is one visible data point in an industry that has grown enormously. Infostealer malware harvested an estimated 1.8 billion credentials in the first half of 2025 alone, pulled from roughly 5.8 million infected devices — an 800% jump over the prior period. A single infection now yields an average of 44 credentials and 1,861 cookies per device, according to the same research.
Cookies specifically have become the more valuable prize. NordVPN researchers who analyzed dark web and Telegram marketplaces over a 12-month period found more than 52.4 billion stolen browser cookies for sale — and even a small fraction of those remaining active is enough to hand an attacker instant access to whatever account that cookie belonged to, no password or 2FA prompt required. Verizon’s Data Breach Investigations Report found that 54% of ransomware victims had their domain credentials appear in stealer-log marketplaces before the attack ever hit — sometimes less than 48 hours before.
Why Your Website Admin Is a Bigger Target Than a Chatbot Login
A stolen Claude session gets an attacker some free AI usage. A stolen WordPress admin session gets an attacker your entire website — your content, your customer data, your search rankings, and a platform to attack your visitors from. The scale of this specific problem is already enormous:
- Roughly 13,000 WordPress sites are hacked every day, and 91% of the vulnerabilities behind those attacks live in plugins, not WordPress core, according to Patchstack’s 2026 security data.
- Wordfence has recorded over 100 billion credential-stuffing attempts aimed specifically at the standard /wp-login.php and /wp-admin paths, and 81% of hacked WordPress sites involved a weak or stolen password as a contributing factor.
- Nulled and pirated plugins or themes — cracked versions of paid software redistributed for free — are one of the most reliable ways malware gets onto a WordPress site in the first place, since distributors routinely embed backdoors before redistribution, and the malicious code can sit dormant for months, surviving basic scans because it’s inside software you deliberately installed. This is the same category of unofficial download — cracked software, patched apps, pirated tools — that caused the original Claude infection.
- Once an attacker has valid stolen credentials, the follow-through is fast: GoDaddy’s security researchers documented an attack chain where criminals logged in with stolen credentials, uploaded a malicious plugin, and had it active within 30 seconds.
- The aftermath is expensive and slow to fix. A hacked site can carry a Google “This site may be hacked” warning for weeks, and only 27% of WordPress site owners have any breach recovery plan in place before an incident happens — meaning most people are improvising during the worst possible moment to improvise.
What Anthropic’s Fix Reveals About the Actual Problem
Anthropic’s own response is instructive precisely because of what it couldn’t do. Revoking sessions stops the specific stolen cookie from working again — but as the company acknowledged, it doesn’t remove the malware itself. If the infection is still on the device, the very next login can be stolen the exact same way.
That’s the part a lot of website security advice skips. Rotating a WordPress admin password after a breach is necessary, but if the compromise started with malware on someone’s laptop rather than a guessed password, a clean password on an infected machine is just a new credential waiting to be harvested. Fixing the account without fixing the device that leaked it is not a fix — it’s a pause.
Hardening a Website Against Session and Cookie Theft
Most WordPress security checklists focus on plugin updates and strong passwords, both necessary but incomplete against session-based attacks specifically. Here’s what actually addresses the mechanism this incident exposed:
- Never install nulled or pirated plugins and themes. This is the single highest-leverage fix available, and it’s free: only install from WordPress.org or a developer’s official site, and if you’ve ever used cracked software on a site, treat it as compromised and run a full malware scan before doing anything else.
- Use phishing-resistant, hardware-backed 2FA on admin accounts where possible. It won’t stop a stolen session cookie, but it meaningfully raises the cost of the initial credential theft that usually precedes it.
- Shorten admin session lifetimes and force re-authentication for sensitive actions. A session cookie that expires in hours rather than weeks gives a stolen credential a much smaller window to be useful — the same logic behind Anthropic’s own decision to revoke sessions en masse.
- Deploy a security plugin that does real malware scanning, not just a firewall. Standard hosting-level defenses block only a minority of WordPress-specific attacks, so a dedicated scanner that checks file integrity against known-good plugin and theme code catches injected backdoors that a generic firewall misses.
- Limit and monitor login attempts on /wp-login.php specifically, since it remains the single most-targeted path on any WordPress site, and rate-limiting or relocating it removes a large share of automated attack traffic for free.
- Keep a written incident response plan before you need one. With only about a quarter of site owners having any plan in place, most incidents get worse in the first hour simply because nobody knows what order to do things in.
This is, in practice, the maintenance work that separates a website that gets hacked once and stays hacked from one that gets hardened after the first close call — or better, never has one. It’s exactly the kind of ongoing security posture we build into every site Craftwebx manages, rather than treating a website as a one-time build with no plan for what happens the day someone’s device gets infected.
FAQ
What exactly happened with Claude and infostealer malware?
Malware running on some users' own computers — not on Anthropic's systems — copied their active Claude login session cookies and reused them to access paid accounts and consume subscription usage. Anthropic revoked the affected sessions, removed saved payment methods, and refunded confirmed unauthorized charges.
Why doesn't two-factor authentication stop this kind of attack?
2FA verifies you at the moment you log in. After that, the site issues a session cookie so you don't have to re-authenticate on every click. Malware that steals this cookie lets an attacker skip the login process entirely — the server has no way to tell the difference between the real, already-authenticated user and someone replaying a stolen cookie.
How is this relevant to my business website if I don't use Claude?
The attack technique — stealing a session cookie via device malware — applies to any website with a login, including a WordPress admin dashboard, an e-commerce backend, or a client portal. A WordPress site is a substantially higher-value target than an AI subscription, since compromising it can expose customer data, damage search rankings, and let attackers use the site itself to spread malware to visitors.
Are nulled or pirated WordPress plugins really that risky?
Yes. Distributors of cracked premium plugins and themes routinely embed backdoors or credential-harvesting code before redistributing them. Because the malicious code sits inside software you intentionally installed, it often survives basic security scans and can remain dormant for months before activating.
What's the single fastest thing a small business can do to reduce this risk?
Audit every installed plugin and theme against its official source and remove anything nulled, pirated, or unmaintained. This closes the most common entry point for the type of malware that leads to both device-level session theft and direct website compromise, at no cost.
