Anthropic Warns Attackers Using Infostealers to Hijack Claude Login

🕵️ RESEARCH & DEEP DIVES

• Anthropic Warns Attackers Using Infostealers to Hijack Claude Login Sessions
  Anthropic is warning Claude users that infostealer malware is being used to hijack their login sessions.

  • Applies to Claude users, whose accounts Anthropic warns are being targeted via compromised login sessions
  • Attackers use infostealer malware to hijack sessions and steal account usage to run their own activities
  • The tactic reflects a broader shift by bad actors from stealing credentials to hijacking session tokens and authentication cookies
    📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)

• Risky Bulletin: BGP hijack delivers malicious Virtualizor updates — Risky Business News

• Divi through 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via... — CVE ThreatInt

• Baserow 2.3.3 - SQL injection in formula index() JSONB array extractionBasero... — CVE ThreatInt

• MapQuest Get Directions App com.mapquest.android.ace ExpoShareIntentModule.kt... — CVE ThreatInt

• WP File Download through 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deleti... — CVE ThreatInt

• FIPS mode assertion failure via malicious CERT payloadIn FIPS mode, Libreswan... — CVE ThreatInt

• Piwigo Image Derivative i.php path traversalA security vulnerability has been... — CVE ThreatInt

• OpenCart Autocomplete Workflow edit.php cross site scriptingA vulnerability w... — CVE ThreatInt

• Keycloak-services: keycloak-services: cross-session email verification proof ... — CVE ThreatInt

• OpenCart Autocomplete Workflow address.php cross site scriptingA vulnerabilit... — CVE ThreatInt

• FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Upda... — CVE ThreatInt

• APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organiz... — CVE ThreatInt

• ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnvION-DTN versions before... — CVE ThreatInt

• AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRe... — CVE ThreatInt

• AgentProv: Auditing Agentic LLM API Providers via Tool-use Policy Probes — arXiv cs.CR

• A Formal Analysis of Agent Payment Protocols — arXiv cs.CR

• Explainable Artificial Intelligence for Industrial Cybersecurity: A Review of Methods, Operational Integration, and Research Challenges — arXiv cs.CR

• DUPIN: Attack Learning Is Still Needed! Demonstrating Few-Shot after Unsupervised Pretraining Is A Nimble Forensics Learner — arXiv cs.CR

• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems — arXiv cs.CR

• Workload Identification with Physical Side Channels for AI Governance — arXiv cs.CR

• OreProof: Verifiable Provenance with Limited Disclosure for Critical-Minerals Supply Chains Using Zero-Knowledge Proofs — arXiv cs.CR

• NeuroPriv: Adversarial Representation Learning for Privacy in Wearable EEG Systems — arXiv cs.CR

• Federated Trust for Embodied Robot Capability Marketplaces — arXiv cs.CR

• Don't Trust the Code, Check Its Effects: Runtime Refinement for Regenerated Systems Code Under an Adversarial Generator — arXiv cs.CR

• Capability-Gated Language Models: Security Composes, Utility Does Not — arXiv cs.CR

• Does Reasoning Mitigate Backdoor Attacks? A Neuro-Symbolic Perspective — arXiv cs.CR

• GlitchLab: A Hardware-in-the-Loop Optimizer for Physical Fault Injection — arXiv cs.CR

• The Safeguard Worked. Is the LLM System Safer? — arXiv cs.CR

• Transferable End-to-End Optimization for Indirect Long-Term Memory Poisoning in LLM Agents — arXiv cs.CR

• SoK: When Safe Agents Fail Together: The Security of Multi Agent LLM Systems — arXiv cs.CR

• NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturing — arXiv cs.CR

• A Version Space Approach for Digital Circuit Analysis — arXiv cs.CR

• Automating Static Code Analysis Through CI/CD Pipeline Integration — arXiv cs.CR

• PhantomCall: Evading ML Malware Detectors via Function Call Graph Perturbation — arXiv cs.CR

• Anthropic Launches Claude Fable and Mythos 5.1 for Advanced Coding and Research — cryptika.com (discovered)

• OWASP Launches OASIS AI Initiative to Fix Open Source Vulnerabilities at Scale — cryptika.com (discovered)