Topic starter
02/09/2026 1:29 pm
TL;DR: Attackers reused active Claude sessions taken from infostealer-infected devices, bypassing passwords and two-factor authentication while consuming paid usage, according to Anomali. The incident shows that once a session token is valid, revoking credentials alone does not end access; token-layer revocation and device cleanup become the real control boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Anomali Cyber Watch: SLEEPWALKER Passive Backdoor, GPUThor Attack Bypasses NVIDIA, Enabling Privilege Escalation and DoS; Fire Ant, TACACS Credential Harvester and more”.
Key questions
Q: What breaks when an attacker steals a browser session instead of a password?
A: Password resets and MFA checks may never fire, because the attacker is already inside an authenticated session.
Q: Why do stolen tokens often survive password resets and MFA changes?
A: Because tokens are issued after authentication and often remain valid independently of later password or MFA updates.
Q: What are the signs that stolen-session replay is happening?
A: Look for account activity while the legitimate user is idle, unexpected quota or usage consumption, new activity from familiar sessions, and changes that do not line up with normal login behaviour.
Practitioner guidance
- Map session revocation coverage Verify which identity systems can invalidate all active sessions after compromise, and which only change passwords or reissue credentials.
- Inventory token-bearing access paths Identify every place where browser cookies, refresh tokens, and saved credentials can be replayed after endpoint theft.
- Harden endpoint exposure to infostealers Treat unmanaged downloads, malicious installers, and browser-profile theft as identity threats, not just endpoint malware.
Bottom line: The incident shows that stolen session tokens can outlast passwords and MFA, so authentication controls alone do not stop account reuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/09/2026 1:30 pm
Session trust has become the real control boundary: this incident shows that authentication success no longer equals secure access once session material is stolen. Passwords and MFA still matter, but they sit upstream of the token boundary that actually governs continued use. Practitioners need to treat the session as the security object that must be governed, because an attacker who already owns a valid token has bypassed the login ceremony entirely.
A few things that frame the scale:
- Patching addresses only about 10% of privilege escalation techniques, while privilege management covers about 65%, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations respond after a session token is confirmed stolen?
A: Immediately invalidate the active session, check whether other sessions for the account are still alive, and clean the endpoint that leaked the token. Then review payment methods, OAuth connections, and any linked identities that could still be trusted through the same account context.
👉 Read our full editorial: Stolen Claude sessions show why session tokens outlast passwords