Technology and Science08 September, 20263 min read
Hackers Target Claude, Cursor, Codex, Cline, Continue, and OpenCode to Steal Credentials
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Info-stealer malware hijacks Claude subscribers' sessions, draining token usage without passwords or 2FA. Attack shifts to steal locally stored data from AI agents, exposing credentials and configs.
6 outlets told this the same way.
Infostealers hijack sessions
Criminals are targeting locally stored data from AI coding agents—including Claude, Cursor, Codex, Cline, Continue, and OpenCode—to steal credentials and sensitive information, according to GBHackers News. On Windows, GBHackers News says Amatera has been observed targeting data related to Cline and Continue, while Remus targets artifacts associated with Claude, Cursor, and OpenCode. The same report warns that where agent files contain plaintext data or reusable authentication material, criminals can collect it by adding a path, filename, database, or extension to an existing remotely managed collection configuration.
Gen Digital’s threat researchers recorded infostealer detections affecting more than 3.3 million unique protected users during the first half of 2026, with monthly totals consistently above 500,000, and GBHackers News says these figures cover the broader infostealer landscape rather than exclusively AI-agent targeting. The report also describes how MCP integrations can expose authorization headers, environment variables, API keys, or other credentials stored in local configurations, and it notes that prompt histories can reveal internal hostnames, repository structures, security controls, customer data, API keys, or trade secrets.
Claude tokens drained
Hackers drained Claude subscribers’ token usage by hijacking active login sessions from victims’ computers, a pattern Anthropic confirmed in response to multiple reports, according to TechCrunch. On August 4, Grant De Swardt, an independent AI consultant in East Sussex, U.K., noticed his Claude Max 20x token usage climbing even though he “hadn’t been working that day,” and he told TechCrunch that “it increased from 45% to 55% while I performed no work.” TechCrunch says Anthropic suspended De Swardt’s paid account, invalidated all of his sessions and server-side Claude Code tokens, and issued him a partial refund of £44.49 for the remaining time on his $200-per-month subscription.
After investigating, TechCrunch reports Anthropic told De Swardt that a compromised Claude session key was used to mint unauthorized Claude Code OAuth tokens, and the company said the account “appeared to have been used by an unauthorized-looking third-party service to handle activity for other people.” TechCrunch adds that account support tracks total usage but not itemized usage, so theft could have gone on for months undetected, and it cites other users describing auto-upgrades, credit card charges, and quota draining without them touching the service.
No itemized proof
The Claude token-drain cases also highlighted a lack of an itemized usage breakdown for users, with TechCrunch reporting that Anthropic didn’t provide De Swardt an itemized list of what was consuming his allowance. TechCrunch says De Swardt contacted Anthropic for an itemized list, but “Anthropic didn’t provide one,” and it notes that he canceled his subscription in favor of Cursor after the difficulty of getting speedy help and the lack of an itemized usage. In emails to affected users, Anthropic warned that “a bad actor that is using common infostealer malware to steal Claude login sessions from people’s computers,” and TechCrunch reports the email said those stolen sessions were then used to access Claude accounts and consume usage.
The GBHackers News report frames the broader threat as attackers exploiting “the growing concentration of high-value data in predictable local locations on endpoints that have already been compromised by commodity infostealers,” linking agent data theft to the same infostealer ecosystem. Together, the sources depict a risk that extends beyond passwords and two-factor authentication, because stolen sessions and local agent data can enable attackers to consume paid capacity and potentially expose operational context like OAuth tokens and MCP configuration artifacts.