In September 2026, Anthropic revealed that a Russian espionage group, tracked as GTG-20006 and linked to Midnight Blizzard (APT29), used Claude at every stage of its operations. The standout finding concerns evasion: AI agents checked whether security products detected the group’s malware, then modified and rebuilt it until it was no longer flagged. For defenders the message is clear: signature-based detection alone no longer slows down an adversary of this calibre.
- More than 20 organizations targeted, mainly government, military, diplomatic and defense entities in Ukraine and Europe, plus a government technology authority in North Africa.
- An automated evasion loop: detection observed, component modified, malware rebuilt, tested again — until nothing flagged it.
- Varied initial access: DNS hijacking through hotel Wi-Fi vendors, Microsoft 365 device code phishing, WhatsApp account takeover and stolen VPN credentials.
- Theft of a complete drone vision system SDK and mailbox exports from at least two drone component makers.
- Anthropic sums up the stakes: “AI has inverted the cost back onto defenders.”
What Anthropic observed
The report, “Detecting and countering misuse of AI: September 2026”, covers activity detected and disrupted between December 2025 and August 2026. Anthropic says its attribution of GTG-20006 is “consistent with public reporting” linking the actor to Midnight Blizzard, a group Western governments attribute to Russia’s SVR foreign intelligence service. One operator used the handle “JackPoterz”.
According to the report, the actor used AI at every stage: reconnaissance, initial access, collection and exfiltration (hundreds of gigabytes processed), and persistence. The human operator’s main job was refining the Claude Code skills that drove these automated workflows.
The automated evasion loop
This is what gives the case its headline. AI monitoring agents checked whether security products flagged the deployed malware. When they did, the agents identified the affected component, modified it, rebuilt the tool and repeated the cycle until it went undetected. The “clean” tools were then staged on disposable hosting servers and delivered through phishing, ClickFix lures or DNS hijacking. Anthropic does not say which security products were tested.
The group added a second layer: companion payloads designed to freeze security updates on compromised machines, so new vendor signatures would never arrive.
A full arsenal, maintained with AI
| Component | Description per the report |
|---|---|
| Windows implants | Two families, including PowerChrome, WUEngine, Shadow C2, MiniPlasma and CloudSyncSvc |
| Android | GiftDrop, a rebranded version of the GiftsExpress surveillance RAT |
| iOS | DarkSword, an exploit chain |
| Supporting tools | Mobile exploitation kit, browser credential stealer, phishing platform mimicking government targets, admin console for compromised accounts |
Multiple ways in
- Hotel Wi-Fi: at least three hospitality vendors compromised; DNS records were changed to redirect guests to ClickFix-style malware for Windows, Android and iOS. Microsoft documented a campaign of this kind, dubbed CaptiveCrunch, in late July 2026 and attributed it to Storm-2945, a Midnight Blizzard sub-cluster.
- Device code phishing: a kit called “Embassy Kit” was used to steal Microsoft 365 tokens from diplomatic and government staff.
- WhatsApp: victims’ accounts were linked as companion devices using headless browsers and the WPPConnect library, with read receipts suppressed and conversations bulk-exported. At least two former senior Ukrainian officials were targeted.
- VPN: in North Africa, stolen VPN credentials gave access to a government technology authority’s central account server, leading to the exfiltration of more than 300,000 national identity records and registry data on more than 500,000 companies.
On the military intelligence side, the actor stole the complete proprietary SDK of a drone vision system and spent several days reverse-engineering it with Claude (architecture, hardware bill of materials, supplier dependencies, an unannounced product). Mail data was exfiltrated from at least eight organizations.
Why it matters for your organization
Until now, every new signature forced attackers into a slow, manual cycle of rewriting their tools. That cost worked in defenders’ favour. By automating the “detected, modified, rebuilt” loop, AI shifts it back onto them. Anthropic stresses that the attacks themselves are familiar; what has changed is their economics.
The direct consequence: a defense strategy built on antivirus and static IOCs loses value against an adversary that can regenerate its tooling continuously. Behavioral detection, log correlation and monitoring the health of security agents become priorities. Business travel, public Wi-Fi and personal messaging apps also remain underestimated entry points for executives and exposed teams.
MITRE ATT&CK mapping
The table below is an indicative Defensy reading based on the behaviors described, intended to help SOC teams prioritize detections.
| Technique | Described behavior |
|---|---|
| T1584.002 — DNS Server | DNS records changed at compromised hotel Wi-Fi vendors |
| T1204.004 — Malicious Copy and Paste | Malware delivered through ClickFix-style lures |
| T1528 — Steal Application Access Token | Microsoft 365 tokens stolen via device code phishing |
| T1027.005 — Indicator Removal from Tools | Malware modified and rebuilt after detection |
| T1562.001 — Disable or Modify Tools | Security updates frozen on compromised machines |
| T1133 — External Remote Services | VPN access with stolen credentials |
| T1114.002 — Remote Email Collection | Bulk mailbox exports from drone component makers |
Recommendations
- ImmediateMonitor the health of your security tools
Alert when an EDR or antivirus stops updating, stops reporting events or has its configuration changed. Treat any endpoint with frozen signatures as suspicious.
- ImmediateBlock the device code authentication flow
In Entra ID, use Conditional Access to restrict device code flow to justified use cases only, and monitor sign-ins that use it.
- Short termFavour behavioral detection
Complement signatures with behavior-based rules: commands pasted from the clipboard, in-memory PowerShell, unusual access to browser credential stores, mailbox exports.
- Short termProtect staff on the move
Enforce the corporate VPN as soon as a device joins a third-party network, raise awareness of fake captive portals and “update” prompts, and apply a strict mobile device policy.
- Short termCheck devices linked to messaging apps
Ask high-exposure profiles to regularly review devices linked to their WhatsApp accounts and revoke any unknown session.
- Medium termHarden remote access
Phishing-resistant MFA on VPNs, detection of anomalous sign-ins and segmentation of central identity servers.
When attackers can regenerate their tools until nothing detects them, defense has to rely on behavior and continuous monitoring, not on signatures alone.
Our SOC, Detection & Response service and the IGIDER Watch platform correlate weak signals across your endpoints, identities and email. Our Training & Awareness programs prepare your teams for ClickFix-style lures and targeted phishing.
- Detecting and countering misuse of AI: September 2026Anthropic — September 2026
- Full report (PDF)Anthropic — September 2026
- Indicators of compromise (CSV)Anthropic — September 2026
- Anthropic caught Russia-linked spies using Claude in hacking operationsThe Record — September 11, 2026
- Russia-linked “Midnight Blizzard” group hijacks hotel wi-fi with CaptiveCrunchiTnews — August 2026
- Russian State-Sponsored Hackers Use Claude to Rebuild Malware After DetectionThe Hacker News — September 2026
- MITRE ATT&CK® — Enterprise MatrixMITRE Corporation
