Anthropic details Claude AI misuse in Android secret theft

Anthropic says multiple threat groups, including the financially motivated ShinyHunters collective and state-sponsored espionage actors, misused its Claude AI model between December 2025 and August 2026, with one operation mass-downloading and scanning 1.8 million Android application packages (APKs) for hardcoded secrets.

Anthropic, the company behind Claude, recorded various forms of artificial intelligence misuse over the eight-month period, including for cyber operations, influence operations, surveillance, scams, development of biological and conventional weapons, and model distillation. The AI firm disrupted several activities linked to ShinyHunters, a collective known for large data theft attacks that often begin with social engineering and account compromise. A suspected French-speaking member using the handle frkoo distributed a credential-harvesting pipeline across ten AWS EC2 workers, which are virtual servers from Amazon Web Services Elastic Compute Cloud. That pipeline downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned them for hardcoded secrets using TruffleHog, a tool that searches files for hidden passwords and keys. Verified findings were sent in real time to a Telegram group organized into more than 100 source types.

The same actor ran a separate automated process to collect GitHub organization email addresses and then used them to obtain GitHub Personal Access Tokens (PATs), which are secret codes used instead of passwords for programmatic access. Anthropic stated that the two pipelines provided initial-access credentials that frkoo used for the bulk of the confirmed breaches associated with that hacker. The actor also set up a carding shop at the domain policenationale[.]cc that impersonated the French national police, selling stolen payment-card records, full cardholder information, and an interactive map of victim addresses. Suspected ShinyHunters members additionally stole AI API keys and used them for breaching other organizations or for reconnaissance. In one case, they breached a software-as-a-service provider and stole data belonging to around 200 downstream customers.

With help from Claude, a suspected ShinyHunters threat actor took about 34 hours to extract authentication data and obtain more than 2,100 sets of Microsoft Azure Active Directory (Azure AD) tokens linked to over 40 separate corporate tenants. Anthropic said AI agents performed nearly all of the work. Other harmful activity attributed to ShinyHunters affiliates included breaching a technology provider and stealing one terabyte of data, compromising an airline, and accessing systems of an energy company. The group moved quickly after gaining initial access. In the case of an enterprise software firm, hackers went to bulk data theft within a few hours. In another instance, an attacker moved from a single stolen developer token to full administrative control in less than three hours.

Anthropic's report also highlights activity attributed to the Russian espionage group known as Midnight Blizzard. The group used Claude to automate malware development, research, infrastructure acquisition, phishing, persistence, command-and-control (C2) operations, and data exfiltration. It set up a feedback loop that rebuilt malware whenever security products detected it. Anthropic observed Midnight Blizzard targeting more than 20 government, defense, diplomatic, intelligence, and foreign-policy entities. The campaigns included device-code phishing, ClickFix attacks, and DNS hijacking, which redirects visitors by altering domain name system records through compromised hotel Wi-Fi providers. They also used WhatsApp account takeovers, cloud-email theft, and malware for Windows, Android, and iOS. Claude was used throughout all attack stages, and the group automated its operations through AI-driven workflows built around Claude Code skills, with human operators mainly modifying those skills when refinement was needed.

Anthropic also describes an espionage operation attributed to a Chinese-speaking group tracked as GTG-10007. The group used Claude as the engineering and orchestration layer of a coordinated offensive program that included intrusion attempts against production systems, reconnaissance of foreign-government networks across the Middle East, Europe, and Southeast Asia, a standing vulnerability-research and exploit development effort against major endpoint-security products, malware development, and building an intelligence-collection platform. The group operated autonomous vulnerability-research workflows while human operators were away, which uncovered multiple previously unknown vulnerabilities in a major security product. The automated effort also delivered working exploits for several families of network and security appliances, and the actor used the exploit code against several government organizations. The operations targeted around 50 organizations across government, education, retail, energy, technology, healthcare, finance, and manufacturing, with confirmed compromises at an education-technology company, a retailer, and a Southeast Asian government agency.

Anthropic said it disrupted the actors' use of Claude for harmful activities, banned the threat actors' accounts, adjusted its guardrails based on the observed malicious use, added measures to detect future misuse faster, and contacted authorities, industry partners, and victims. For website owners and IT teams, this kind of AI-assisted credential theft is a reminder to review how secrets and access tokens are handled; AEU-I offers security-first IT, infrastructure and consulting that can help organizations assess the kind of credential and API key handling that attackers exploited in these operations.