The familiar ClickFix fake CAPTCHA trick has been adapted to deliver a payload that can give attackers access to the victim’s wider network.

Anthropic has warned that infostealers are stealing Claude session cookies to access users’ accounts and consume usage at their expense.