Skip to content
NewsIncident

Infostealers Targeting Claude Accounts Can Reach Corporate Gmail via OAuth Grants No IT Admin Can Revoke

· by Pondero Newsdesk

The short version

Anthropic disclosed a session-cookie theft campaign targeting self-serve Claude accounts. A September 2 VentureBeat analysis found the attack can reach corporate Gmail, Drive, and Calendar through OAuth grants that Google Workspace admins cannot see or revoke.

Infostealers Targeting Claude Accounts Can Reach Corporate Gmail via OAuth Grants No IT Admin Can Revoke

Anthropic disclosed a session-cookie theft campaign targeting self-serve Claude accounts around August 30, 2026. A September 2 VentureBeat analysis found the exposure extends beyond drained usage: replayed session cookies can access corporate Gmail, Google Drive, and Google Calendar through OAuth grants that no Google Workspace administrator can see or revoke.

What happened

Anthropic notified affected users that six infostealer malware families were lifting Claude login cookies from infected machines and replaying them to drain account usage. Per BleepingComputer's August 30 report, the named families are Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS. Anthropic signed affected accounts out, removed saved payment methods, and refunded unauthorized charges.

Session-cookie replay bypasses 2FA and SSO alike. A stolen cookie authenticates as the person who already passed the login checkpoint, so signing out is the only downstream remedy once a cookie leaves the machine. Anthropic told affected users the malware was "not related to Claude" and represented general-purpose browser-credential theft that targeted Claude sessions alongside passwords and other cookies on the same infected device.

The OAuth blind spot

The VentureBeat analysis identified a second, distinct exposure. Claude's web login lets users authorize Google Workspace connectors covering Gmail, Drive, and Calendar. Anthropic's connector help article confirms these are available to individual accounts, meaning a personal Pro subscription can hold a live authorization into a work inbox or Drive folder.

Those authorizations are issued at the personal-account level, not through a corporate identity provider. An attacker holding a replayed Claude session inherits whatever Google Workspace connectors the account holder had authorized. The Google Workspace administrator for the corporate tenant has no visibility into that grant and no administrative path to revoke it. The grant survives even after Anthropic signs the Claude account out.

Per Anthropic's connector documentation, read and search operations run without per-action approval. An attacker with the replayed session can read email and Drive contents without triggering an additional approval prompt.

The targeted accounts were card-billed and self-serve. That population includes personal subscriptions and can include Team or self-serve Enterprise organizations. SSO-enforced corporate accounts are governed by an identity provider, but card-billed personal accounts are not, even when they sit on managed laptops.

Why it matters

The burned usage from this campaign is bounded. Anthropic refunded it. The OAuth exposure carries no equivalent cleanup.

Enterprise IT teams that assume Claude access is governed by SSO controls should audit whether employees are running personal Claude accounts with Google Workspace connectors authorized on work devices. A personal Claude account on a work machine sits outside the corporate identity provider scope. If that account holds a Gmail connector and an infostealer reads the browser cookie store, the attacker's read path into corporate email bypasses identity and access management controls entirely.

The concrete action: require Claude access through enterprise accounts enforced by a corporate SSO provider rather than self-serve billing. Teams on a Claude Team or Enterprise plan with SSO enforced are outside the at-risk population for this specific attack vector. Teams that allow employees to self-provision personal accounts on managed devices are not.

What to watch next

Whether Anthropic adds OAuth-grant visibility and revocation to the Claude admin console, and whether Google Workspace updates its audit logs to surface personal-account Claude connector authorizations to tenant administrators.

Sources