Product

Azure AD

1 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 8, 2026 · last 4d ago

Timeline2 articles

Hackers abused Claude to extract secrets from 1.8M Android apps

Anthropic reports ShinyHunters, Midnight Blizzard, and GTG-10007 misused Claude to automate credential theft, malware operations, and espionage against dozens of victims.

Anthropic's threat report details how ShinyHunters member 'frkoo' ran a credential-harvesting pipeline on ten AWS EC2 workers that mass-downloaded and decompiled 1.8 million Android APKs, scanning for hardcoded secrets with TruffleHog. In one AI-assisted operation, an actor extracted 2,100+ Azure AD authentication tokens across more than 40 Microsoft tenants in roughly 34 hours, and ShinyHunters affiliates also stole AI API keys and breached a SaaS provider affecting about 200 downstream customers. Russian espionage group Midnight Blizzard used Claude Code skills to automate malware development, phishing, C2, and exfiltration against 20+ government and defense entities, rebuilding malware automatically when detected. Chinese-linked GTG-10007 ran autonomous vulnerability research that uncovered zero-days in a major endpoint security product and hit roughly 50 organizations with confirmed compromises; Anthropic disrupted the abuse and banned the accounts.

BleepingComputerupdated Sep 12, 10:30 UTC · 3d agofirst Sep 11, 20:19 UTC · 4d agoThreat actor in the wild 11 sources1

BigBear 2 PhaaS Campaign Steals 5000+ Microsoft Credentials

CloudSEK researchers found the BigBear 2.0 PhaaS kit, built on Evilginx2, has stolen over 5,100 Microsoft 365 credentials across 461 organizations in 40+ countries.

CloudSEK gained admin access to the BigBear 2.0 phishing-as-a-service panel, an Evilginx2-based adversary-in-the-middle platform operated by someone using the alias 'General Boss'. The team observed 3,331 unique victim IPs across more than 40 countries, 42 VPS nodes mostly on Vultr, and 5,137 credential records across 461 organizations, including 4,148 session cookies, 1,032 plaintext passwords, and 474 completed MFA-bypassed authentications. IT and managed service providers were the most targeted sector, raising supply-chain risk since their compromise can expose client infrastructure and privileged Azure AD access.

Infosecurity MagazineSep 8, 09:45 UTC · 7d agoPhishing & fraud in the wild

Appears with

vendor Microsoft 2 threat actor GTG-10007 1 threat actor Midnight Blizzard 1 threat actor ShinyHunters 1 malware BigBear 2.0 1 malware Evilginx2 1 ai model Claude 1 organization Anthropic 1 product AWS EC2 1 product Claude 1 product Claude Code 1 product Microsoft 365 1 product TruffleHog 1 vendor Anthropic 1 vendor AWS 1 vendor CloudSEK 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.