In its September 2026 report on malicious use of its models, Anthropic describes several clusters of suspected ShinyHunters affiliates, tracked as GTG-50014, who used Claude to industrialize credential hunting, intrusion and data theft. In one case, a single stolen developer token was enough to gain full administrative control of a cloud environment in about three hours. The way in was anything but exotic: secrets left behind in code, mobile apps and repositories.
- Anthropic links the activity to several clusters of suspected affiliates of ShinyHunters, a collective known for data theft followed by pay-or-leak extortion.
- A pipeline spread across 10 AWS EC2 workers downloaded around 1.8 million Android apps, decompiled them and scanned them for hardcoded secrets with TruffleHog.
- AI agents did most of the work in several intrusions: more than 2,100 Azure AD token sets collected across 40+ tenants in roughly 34 hours.
- AI API keys stolen from victims were reused for about three weeks to fuel further attacks.
- Anthropic banned the accounts, built new detections and shared intelligence with authorities, industry partners and victims.
What Anthropic’s report reveals
The report, “Detecting and countering misuse of AI: September 2026”, covers malicious operations Anthropic detected and disrupted between December 2025 and August 2026. The GTG-50014 case groups several attacker clusters that used separate tooling but that Anthropic assesses to be part of a single operation. Their business model is familiar: steal data, then threaten to publish it unless the victim pays.
What has changed is the method. The report describes “vibe hacking”: the operator sets a broad goal and lets the AI assess the environment, write and run scripts, and iterate until the job is done. In several intrusions, AI agents did nearly all of the work.
An industrial credential-harvesting pipeline
According to Anthropic, initial access relied mostly on compromised credentials obtained through several channels:
- Mobile apps: a French-speaking operator (aliases “MeowSHA”, “frkoo”, “blazespider”) ran 10 AWS EC2 workers that downloaded about 1.8 million Android APKs from multiple stores, decompiled them and scanned them with TruffleHog. Verified secrets were pushed in real time to a Telegram group organized into more than 100 source types.
- GitHub: a second automated process harvested GitHub organization emails and fed the theft of Personal Access Tokens.
- Exposed secrets: tokens scraped from code repositories, containers and client-side code.
- Social engineering: phishing, vishing and domain spoofing to get employees to hand over access.
- AI API keys: keys stolen from software vendors during intrusions and then reused.
According to BleepingComputer, the two automated pipelines (APK and GitHub) supplied the initial-access credentials for most confirmed breaches.
Intrusions measured in hours
| Victim (unnamed) | What Anthropic described |
|---|---|
| Technology provider | Over 1 TB exfiltrated, including national identifiers and millions of payment card records, posted publicly to push for a ransom |
| Airline | Access to systems holding tens of millions of passenger records |
| Energy company | Attackers claimed they could control the current of home EV chargers |
| SaaS provider | Breach reaching about 200 downstream customers; 2,100+ Azure AD token sets across 40+ tenants in roughly 34 hours |
| Enterprise software vendor | From first access to bulk data theft within hours |
| Cloud environment | From one stolen developer token to full administrative control in about three hours |
The report also describes steps taken to make access stick: minting new credentials, forging sessions and 2FA codes, and planting network backdoors so access survives credential rotation. Two victims reportedly even paid the attackers bug bounty rewards of $2,000 and $5,000.
Why it matters for your organization
This case shows where the risk is moving. The attackers did not need a novel vulnerability: a secret forgotten in a mobile app, a GitHub token or an overly permissive cloud key was enough. What AI removed was the human bottleneck — exploring an unfamiliar environment, working out what a credential can do, writing extraction scripts. What used to take days now takes hours.
Second lesson: AI API keys are now assets in their own right. Stolen from one victim, they fund the rest of the campaign. Anthropic explicitly recommends treating AI keys and agent integrations as seriously as production credentials, and buying AI access only through authorized channels.
Finally, the knock-on effect is real: compromising a single SaaS provider exposed around 200 customer organizations. Your attack surface includes your suppliers’.
MITRE ATT&CK mapping
The table below is an indicative Defensy reading based on the behaviors described in the report, intended to help SOC teams prioritize detections.
| Technique | Described behavior |
|---|---|
| T1593.003 — Code Repositories | Hunting for secrets in public code repositories |
| T1552.001 — Credentials In Files | Hardcoded secrets extracted from decompiled Android APKs |
| T1566.004 — Spearphishing Voice | Vishing to obtain access from employees |
| T1078.004 — Cloud Accounts | Cloud access using stolen developer tokens |
| T1528 — Steal Application Access Token | Collection of 2,100+ Azure AD token sets |
| T1496 — Resource Hijacking | Victims’ AI API keys reused for compute for about three weeks |
| T1657 — Financial Theft | Extortion by threatening to leak stolen data |
Recommendations
- ImmediateHunt for secrets in your apps and repositories
Scan your published APK/IPA builds, repositories (including Git history), container images and front-end code with a secret-detection tool. Revoke and rotate any key you find right away: deleting it from the code is not enough.
- ImmediateShorten token lifetime and narrow scope
Replace classic Personal Access Tokens with fine-grained, short-lived tokens, enforce SSO on your GitHub organization, and audit active tokens and authorized OAuth apps.
- Short termTreat AI API keys as production secrets
Store them in a vault, scope them per project, set spending caps and alert on usage spikes or calls from unusual origins.
- Short termDetect fast cloud escalation
Watch your cloud and Entra ID logs for new credentials, admin role assignments, sign-ins with replayed tokens and bulk exports. A three-hour path from access to full control demands real-time alerting.
- Short termHarden against vishing
Formalize a verification procedure for any access or MFA-reset request received by phone, especially at the IT help desk.
- Medium termAssess your SaaS suppliers’ exposure
Inventory third-party integrations and their rights over your data, require incident-notification clauses, and plan for fast revocation of integration tokens if a supplier is compromised.
This case is a reminder that AI mostly speeds up the exploitation of what you forgot: a secret in a mobile app, an over-privileged GitHub token, a cloud key never rotated. Finding them before the attacker does is the most cost-effective measure.
With IGIDER Strike, we continuously identify your exposed assets and truly exploitable weaknesses. Our SOC, Detection & Response service watches for privilege escalation and exfiltration, and our Secure AI Adoption offering helps you govern API keys and AI agents.
- Detecting and countering misuse of AI: September 2026Anthropic — September 2026
- Full report (PDF)Anthropic — September 2026
- Indicators of compromise (CSV)Anthropic — September 2026
- Hackers abused Claude to extract secrets from 1.8M Android appsBleepingComputer — September 11, 2026
- Anthropic caught Russia-linked spies using Claude in hacking operationsThe Record — September 11, 2026
- Claude Used to Automate Exploitation and Data Theft Across Multiple VictimsThe Hacker News — September 2026
- MITRE ATT&CK® — Enterprise MatrixMITRE Corporation
