Cyber Edition

🚨 Claude Sessions Stolen by Infostealer Malware A Claude user has shared what appears to be a security notification sent by the Claude Team warning that threat actors are actively stealing authenticated Claude login sessions using commodity infostealer malware. According to the notification: * Infostealers are stealing Claude login sessions directly from infected computers * Attackers are then replaying those sessions to access Claude accounts and consume victims' usage * Anthropic says the activity is NOT related to malware distributed through Claude * Phones and tablets do not currently appear to be involved The malware families identified in the campaign so far reportedly include: * Vidar * Lumma / LummaC2 * StealC * RedLine * Acreed * Atomic Stealer (AMOS) on a small number of Macs For affected accounts, Anthropic says it has: * Invalidated the compromised Claude sessions * Removed stored payment methods * Refunded charges identified as unauthorized * Recommended that affected users scan their computers and secure associated accounts ⚠️ Analyst Note: This is another example of why MFA alone cannot solve the infostealer problem. Instead of stealing a password and attempting a new authentication, an attacker can steal an already-authenticated browser session. That session may allow the attacker to effectively "become" the authenticated user until the session is revoked. The bigger trend is worth watching: Infostealer → browser/session theft → authenticated SaaS access → account abuse AI platforms are becoming another valuable target within this ecosystem. Important: This information comes from an apparent Claude customer security notification shared publicly. We have not identified a corresponding public Anthropic security advisory at this time. Credit: Reddit user u/WorriedAssociate7029 for sharing the notification. #DDW #CyberSecurity #Infostealer #Claude #Anthropic #ThreatIntelligence

🇫🇷 France | Ministry of Culture Allegedly Targeted A threat actor has claimed to have breached France's Ministry of Culture (culture.gouv.fr), advertising what it says is a dataset containing information on 45,362 users. According to the forum post: * The actor claims an IDOR (Insecure Direct Object Reference) vulnerability was used to access the data. * The alleged dataset contains 45,362 records. * Sample data appears to include names, email addresses, phone numbers, organizational affiliations, job titles, and internal directory information. * The actor states the dataset primarily contains professional contact information. Daily Dark Web has not independently verified the authenticity of the claim or confirmed that the French Ministry of Culture experienced a security breach. Analyst Note: IDOR vulnerabilities remain a common cause of unauthorized data exposure when object-level access controls are not properly enforced. Claims involving government systems should be treated as unverified until supported by official disclosures or independent technical validation. #DDW #Intelligence #DarkWeb #France

🌐 Accenture | Alleged Source Code Leak Advertised A threat actor is advertising what they claim is a large-scale breach of **Accenture**, alleging the theft of more than **35 GB** of internal data. According to the forum post, the stolen data allegedly includes: * Source code repositories. * RSA keys. * SSH keys. * Azure Personal Access Tokens (PATs). * Azure Storage Access Keys. * Configuration files. The actor claims the data was stolen in **July 2026** and is offering the archive for sale, alongside a sample file tree. Daily Dark Web has **not independently verified** the authenticity of the claims or confirmed that Accenture has experienced a breach matching the advertised dataset. Analyst Note: If authentic, the exposure of source code combined with cryptographic keys and cloud credentials would represent a high-severity supply chain risk, potentially enabling unauthorized access to internal environments, customer assets, or downstream development infrastructure. #DDW #Intelligence #DarkWeb #Accenture