Stolen Claude session cookies can reach corporate Gmail through grants no IT admin can revoke

Infostealer malware stole Claude session cookies from infected PCs and replayed them to access paid accounts, bypassing two-factor authentication and SSO. Anthropic notified affected users, signed the accounts out, removed saved payment methods, and refunded charges. The attack targeted card-billed, self-serve accounts that do not use corporate identity providers.