Cyber Security News reported on 2026-08-31 that several information-stealing malware families - Vidar, Lumma, StealC, RedLine, Acreed on Windows and Atomic Stealer on macOS - have been used to collect browser cookies, saved passwords and other credentials from devices running Anghropic's Claude AI platform. ^[1] Security researchers from Huntress reported that North Korean job seekers are expanding their fraudulent recruitment campaigns from the technology sector into healthcare, sales, and marketing industries. ^[2] Anthropic identified cases in which attackers appeared to consume paid Claude usage after account owners had stopped using the service, indicating session cookies had been reused. ^[3] Anthropic responded to the malware threat by signing affected accounts out, removing stored payment methods and refunding confirmed frudulent charges, but warned that these measures do not remove malware from infected devices, according to Cyber Security News. ^[4] Stolen session cookies from Claude accounts can allow attackers to impersonate an already-authenticated user, potentially bypassing passwords and two-factor authentication. ^[5] Employing North Koreans is prohibited under US sanctions, and the US government specifically warns against hiring IT workers from the Democratic People's Republic of Korea (DPRK). ^[6] Huntress investigated a case involving an Australian healthcare company where three individuals were found to be North Koreans impersonating Chinese nationals. ^[7] North Korean applicants are using stolen identities, forged documents, and pre-recorded or AI-generated videos during interviews to trick Western employers. ^[8]