Anthropic has issued a formal security warning disclosing that multiple infostealer malware campaigns are actively targeting Claude API credentials and session tokens, with harvested access subsequently resold in criminal marketplaces. The advisory, published via Anthropic's security channels, details how malware families—including established info-stealing variants like Redline, Vidar, and Lumma—are being used to exfiltrate authentication material from developer machines, browser caches, and environment variable configurations. The threat is not theoretical: Anthropic's security team has confirmed observations of stolen Claude credentials being advertised and traded on underground forums, indicating an organized effort to monetize access to the platform. This represents a significant shift in the threat landscape around generative AI infrastructure, where API keys—once viewed as lower-value secrets—are now actively sought and weaponized by criminal syndicates.
The malware distribution vectors vary, but typically involve phishing campaigns delivering trojanized development tools, compromised software packages, or browser extensions that harvest credentials from local machine storage. Once harvested, infostealer malware exfiltrates .env files, browser autofill data, bash history logs, and in-memory session tokens. Criminals then test stolen credentials against Anthropic's API to verify their validity before listing them for sale on Telegram channels and darknet marketplaces, where a single valid Claude API key with usage quota can fetch anywhere from $50 to several hundred dollars depending on associated rate limits and account age. Attackers leverage compromised accounts to drain API quotas, launch prompt injection attacks, or use Claude's capabilities for downstream malicious purposes—from code generation for malware to social engineering content creation.
In response, Anthropic has issued concrete mitigation guidance: developers should immediately rotate all Claude API keys and session tokens, enable API key restrictions to limit scope and usage patterns, and implement environment variable isolation rather than hardcoding credentials in .env files. The company recommends authenticating via Anthropic's OAuth flow for applications requiring user-facing access, avoiding storing credentials in browser storage, and utilizing OS-level credential managers (such as macOS Keychain or Windows Credential Manager) that employ encryption and access controls. Additionally, Anthropic is advising customers to monitor API usage logs for anomalous activity—sudden geographic shifts in request origins, bulk token consumption, or requests to sensitive endpoints. Security researchers have noted that this campaign reflects a broader trend: as AI providers scale, their API credentials become economically valuable targets. The incident underscores that API key hygiene is now a critical security practice for any organization deploying Claude at scale, and that infostealer malware—traditionally focused on payment cards and passwords—has evolved to target generative AI infrastructure as a revenue stream.