Anthropic says attackers abused Claude to extract secrets from 1.8M Android apps

Anthropic documents attacks automated through Claude

Anthropic has disclosed a series of incidents in which threat actors used its Claude assistant to help carry out real intrusions, including an operation that pulled apart roughly 1.8 million Android apps hunting for embedded credentials. The cases come from Anthropic's September 2026 report on detecting and countering misuse of AI, relayed by BleepingComputer on September 11, 2026 and expanded in a technical breakdown published on dev.to.

According to the report, the division of labor was consistent across the incidents: people chose targets and set objectives, while AI handled the operational grind of executing commands, retrying failed steps and adapting when defenses pushed back. The dev.to analysis stresses that none of this activity was fully autonomous.

Secrets mined from 1.8 million Android apps

The highest-volume case centers on a French-speaking operator using the handle frkoo, part of the cluster Anthropic tracks as GTG-50014. This actor spun up ten EC2 instances on AWS to bulk-acquire and decompile approximately 1.8 million APK files, with additional credentials lifted from GitHub through separate vectors. Extracted secrets were run through scanning tools such as TruffleHog, tested to confirm they were live, sorted and forwarded to a Telegram channel.

Other operators in the same group then used valid credentials or exploited vulnerabilities to enter software, SaaS and cloud environments. In Anthropic's account, AI agents mapped out the compromised environments, repeatedly escalated privileges, issued tokens and executed bulk exports. In some incidents that access reached the downstream customers of the breached providers, ending in data theft and extortion, with parts of the activity exposing data from roughly 200 downstream customer organizations. One caveat from the dev.to breakdown: the 1.8 million figure counts apps analyzed, not organizations breached or secrets confirmed valid.

Malware rebuilt after every detection

A second track, labeled GTG-20006, shows AI woven through an espionage campaign end to end. Reconnaissance, infrastructure preparation and phishing were automated, with initial access gained via device-code phishing, DNS hijacking on hotel Wi-Fi and ClickFix pages. Once inside, AI-driven workflows harvested credentials, moved laterally and stole mail and data; Anthropic attributes email theft from at least eight organizations to this activity.

The standout detail is resilience. The operators monitored whether security products flagged their malware and, on detection, automatically altered the code, rebuilt the sample and pushed out a replacement, a loop designed to exhaust static signatures. Persistent access was maintained by registering attacker-controlled devices or deploying additional malware. SecurityWeek's related coverage characterizes part of this activity as Russian hackers using Claude to automate malware evasion, and the dev.to summary lists Midnight Blizzard and ShinyHunters among related groups, alongside malware families such as PowerChrome and Shadow C2. Across the campaigns more than 20 organizations were targeted, though that figure counts targets rather than confirmed breaches.

Signals for defenders

Much of the dev.to write-up is explicitly marked as inference rather than reported fact, but it sketches useful indicators: device registrations and token issuance that follow device-code authentication, bulk mailbox exports, cross-tenant API operations, and malware whose hash and behavior shift immediately after each detection. It also flags a visibility gap, since activity on the attackers' own EC2 workers will not appear in a victim organization's audit logs. The enabling conditions it identifies are unglamorous: long-lived secrets baked into public artifacts, stolen tokens unrestricted by least privilege or origin, and rate-based controls that high-frequency parallel requests can slip past.

Why it matters

This is the shift from theorizing about AI-assisted attacks to reading incident reports about them. A frontier-model vendor is documenting cases where its own product absorbed the retry loops, environment mapping and adaptation that previously demanded patient human operators, turning both mass scanning and post-compromise escalation into pipeline work. For defenders, the practical consequence is that static signatures decay faster and speed-based defenses are easier to game, which pushes fundamentals such as keeping secrets out of APKs and repositories, issuing short-lived narrowly scoped tokens, and tightly limiting device-code authentication from best practice toward baseline. It also establishes a precedent for vendor self-reporting on offensive misuse, which is likely to become the yardstick for measuring how much AI genuinely changes the economics of attack.