Product

AWS EC2

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 11, 2026 · last 4d ago

Timeline2 articles

Hackers abused Claude to extract secrets from 1.8M Android apps

Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.

Anthropic's threat report details how ShinyHunters member 'frkoo' ran a credential-harvesting pipeline on ten AWS EC2 workers that mass-downloaded and decompiled 1.8 million Android APKs, scanning for hardcoded secrets with TruffleHog. In one AI-assisted operation, an actor extracted 2,100+ Azure AD authentication tokens across more than 40 Microsoft tenants in roughly 34 hours, and ShinyHunters affiliates also stole AI API keys and breached a SaaS provider affecting about 200 downstream customers. Russian espionage group Midnight Blizzard used Claude Code skills to automate malware development, phishing, C2, and exfiltration against 20+ government and defense entities, rebuilding malware automatically when detected. Chinese-linked GTG-10007 ran autonomous vulnerability research that uncovered zero-days in a major endpoint security product and hit roughly 50 organizations with confirmed compromises; Anthropic disrupted the abuse and banned the accounts.

BleepingComputerupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 20:19 UTC · 4d agoThreat actor in the wild 11 sources1

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic's 154-page report details Generative Threat Groups, including APT29-linked GTG-20006 and ShinyHunters affiliates, using Claude for reconnaissance, exploitation, and data theft.

Anthropic reports that between December 2025 and August 2026 state-sponsored hackers, criminals, spyware vendors, and propaganda operators used its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance. Notable clusters include GTG-50014, a ShinyHunters affiliate that scanned 1.8 million Android APKs for secrets via 10 AWS EC2 workers, GTG-10007, a Chinese-speaking group targeting roughly 50 organizations, and GTG-50029, a lone French-speaking actor exploiting a previously undocumented WordPress re-installation race condition. The report describes multi-agent frameworks autonomously executing reconnaissance, exploitation, and exfiltration against multiple victims, and influence operations that were disrupted before building authentic audiences.

The Hacker Newsupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 14:29 UTC · 4d agoThreat actor in the wild 11 sources1

Appears with

threat actor GTG-10007 2 product Claude 2 threat actor Midnight Blizzard 2 product TruffleHog 2 vendor Anthropic 2 threat actor ShinyHunters 2 ai model Claude 2 organization Anthropic 2 vendor AWS 1 vendor GitHub 1 threat actor APT29 1 vendor Microsoft 1 threat actor GTG-20006 1 threat actor GTG-50014 1 threat actor GTG-50020 1 threat actor GTG-50021 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.