Infostealers کوکی‌های جلسه کلود را مستقیما پس از 2FA پخش کردند. حساب‌هایی که شواهد به آنها اشاره می‌کنند، اشتراک‌های شخصی خارج از SSO شما هستند

Infostealers replayed Claude session cookies straight past 2FA. The accounts the evidence points to are personal subscriptions outside your SSO

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards. The accounts Anthropic flagged were card-billed, self-serve accounts, which is the population no corporate identity provider governs, and no admin console can sign out. Session-cookie replay bypasses SSO as thoroughly as it bypasses 2FA. What SSO provides here is revocation…