Hackers Are Stealing Tokens From Claude Subscribers

Anthropic has warned subscribers of Claude, a widely used AI agent for business tasks, about a new threat: attackers are not stealing logins and passwords but active login sessions — infostealer malware lifts them straight off the user's computer, then signs into the account and burns through paid tokens. The alert followed a report from a subscriber whose account was consuming tokens while he wasn't using the service at all; the company terminated the rogue sessions, revoked authorisations and refunded part of the usage.

The case shows that access to an AI agent today is not just a login and password — it's effectively access to a company's money and working data, since a compromised account can expose chat history, documents, and connected systems. The more actively a business relies on AI agents for daily work, the more valuable each account becomes, and the more attractive a target it is for fraudsters.

For business owners in Kazakhstan the key point is this: two-factor authentication and routine password changes do not protect against a stolen session — the attacker never goes through the login step at all. What does work: clean work machines with no pirated software or random browser extensions, signing out of all sessions immediately on suspicion, and watching for unusual token consumption. In 1Cifer every employee's access is limited by their role and the company's structure, and everything an agent does stays in the history — someone else's activity in an account shows up straight away, not on the invoice at the end of the month.