Anthropic: infostealers stole Claude login sessions and drained user usage. Not LLMjacking. That is API key theft, fixed by rotating the key. This is session cookie theft, and per Anthropic the attacker may skip password and 2FA entirely. Change your password on an infected machine and you just minted them a new cookie. Clean first, revoke second, rotate third. [https://blog.relayshield.net/this-is-not-llmjacking-and-rotating-your-key-will-not-fix-it]