Malware

Infostealer malware, including families such as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic Stealer on macOS, is stealing active Claude session cookies from infected computers.

The Windows infostealer uses several evasion measures to remain mostly invisible to security systems.

Discovered by malware researcher Dominik Reichel, Sleepwalker impersonates Microsoft's dpapi.dll and loads via side-loading into ESET Management Agent.

The attack uses iframes embedded in Google Sites to deliver malicious content from a trusted domain.

The latest Agent Tesla campaign utilizes a JScript dropper that incorporates Unicode emoji characters to disrupt signature-based detection and obscure the malicious code.