MediumEarly warningMalwareRussia · English

Claude Hacked? Info-stealing malware steals tokens from subscribers

First seen 9 Sept, 14:00 WIBLatest 9 Sept1 articles · 1 publishers

victim: claudeVerify evidence

Confidence index · preliminarycomputed by the pipeline (V0.7)low

Corroborated by distinct domains

Independent sources

Victim identified

Full text available

Clustering consistency

Status and preventive steps

Early warningMachine output from news coverage; not verified by the public or institutions

Preventive steps

Apply least-privilege access, back up data, and train staff to spot phishing.
Install apps only from official stores and never open APK files sent over chat.
Keep the operating system and apps updated and leave built-in protection on.

Literacy audienceExecutives and managersIT staff and system administrators

Literacy topics

The danger of APK files and unofficial apps
System updates and security patches
How to report and keep evidence

Report toPatroli Siber Polri

Extracted claims

Victimconfidence 0.60

Claude

Actornot found

not identified

Attack typeconfidence 0.90

Malware

Event datenot found

not identified

LocationRussia

Target groupBusinesses

Status

D1 Machinelow trust

Conclusion

D1 MachineNot yet certain

Other incidents with the same victim

Claude hit by infostealer malware campaign stealing session credentials; Anthropic force-logs-out users and wipes payment info

Malware1 articles · 1 domains · claude

Source chronology

1 articles, by publication time

9 September 20261 articles

14:00 WIBFirst reportfull text hashed
Claude Hacked? Info-stealing malware steals tokens from subscribersbasic-tutorials.comClaude

Relations between articlesSingle source; no article pairs to compare.

Evidence

Hashes prepared1full text hashed 1

first evidence_uida598613cb3a1dbead93b1480

1 of 1 evidence records are in Merkle batches

Flow comparison D1–D4

each flow's preventive output; this is where they differ · D1 changed 2 times · since 29 Sept

	D1Machine12 Oct	D2Public surveynone yetHelp review	D3Institutionnone yet	D4Official recordnone yet
Literacy audience	Executives and managersIT staff and system administrators	–	–	–
Literacy topics	1.The danger of APK files and unofficial apps 2.System updates and security patches 3.How to report and keep evidence	–	–	–
Preventive steps	Apply least-privilege access, back up data, and train staff to spot phishing. Install apps only from official stores and never open APK files sent over chat. Keep the operating system and apps updated and leave built-in protection on. Report to Patroli Siber Polri	–	–	–
Institution's reason	–	–	–	–

Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents

Related incidents

semantic similarity of the coverage, across languages

Malware1 articles · 1 domains