Claude abused across 1.8M Android apps

Anthropic says it spent eight months watching threat actors try to turn its Claude AI model into a tool for credential theft, malware development, and espionage — and in at least one case, it says, their pipeline ground through 1.8 million Android apps. The findings, which Anthropic says cover December 2025 through August 2026, describe misuse that spans financially motivated crime and state-backed spying.

The company says it disrupted the activity, banned the accounts involved, adjusted its guardrails, and contacted authorities, industry partners, and victims. The details name specific threat groups and specific operations, and they map out how much of an intrusion can now be automated.

ShinyHunters and the APK pipeline

The most detailed case in Anthropic's account involves the ShinyHunters collective, described as infamous for massive data theft attacks that typically begin with social engineering and account compromise. An alleged French-speaking member of the group, using the handle 'frkoo', Anthropic says, ran a credential-harvesting pipeline across ten AWS EC2 workers.

Those workers downloaded apps from multiple stores, then scanned them for hardcoded secrets. According to Anthropic, the operation mass-downloaded 1.8 million distinct Android APKs, decompiled them, and scanned for secrets using TruffleHog. Verified findings, the company says, were routed in real time to a Telegram group organized into more than 100 source types.

The same actor, according to Anthropic, ran a separate automated process to collect GitHub organization email addresses and use them to obtain GitHub Personal Access Tokens, or PATs. Together, the two pipelines provided initial-access credentials that 'frkoo' used "for the bulk of the confirmed breaches" associated with the hacker.

"This pipeline mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog."

— Anthropic, in its threat intelligence report

Anthropic also says 'frkoo' set up a carding shop at the domain policenationale[.]cc, impersonating the French national police to sell stolen payment-card records, full cardholder information, and an interactive map of victim addresses. The company says the ShinyHunters-linked actors it observed didn't stop at credentials. Suspected members also stole AI API keys and used them to breach other organizations or conduct reconnaissance.

Hours, not weeks, to full control

Anthropic says a suspected ShinyHunters threat actor needed roughly 34 hours to extract authentication data and obtain more than 2,100 sets of Azure AD authentication tokens linked to over 40 separate corporate Microsoft tenants — with Claude doing nearly all the work. "AI agents performed nearly all of the work," the company states in its account of the operation.

Other activity Anthropic attributes to ShinyHunters affiliates includes breaching a technology provider and stealing 1TB of data, compromising an airline, and accessing systems of an energy company. In one case involving a software-as-a-service provider, the actors breached the company and stole data belonging to around 200 downstream customers.

The speed is a recurring theme in Anthropic's writeup. At an enterprise software firm, the hackers moved to bulk data theft in just a few hours. In another instance, Anthropic says, the attacker went from a single stolen developer token to full administrative control in less than three hours.

Midnight Blizzard's feedback loop

Anthropic's report also covers activity attributed to the Russian espionage group known as Midnight Blizzard, which the company says used Claude to automate malware development, research, infrastructure acquisition, phishing, persistence, command-and-control operations, and data exfiltration. The group set up a feedback loop that rebuilt malware whenever security products detected it, according to Anthropic.

Anthropic says it observed Midnight Blizzard targeting more than 20 government, defense, diplomatic, intelligence, and foreign-policy entities. The campaigns included device-code phishing, ClickFix attacks, DNS hijacking through compromised hotel Wi-Fi providers, WhatsApp account takeovers, cloud-email theft, and Windows, Android, and iOS malware — with Claude, the company says, used throughout all attack stages.

Midnight Blizzard automated its operations through AI-driven workflows built around Claude Code skills, with the human operator primarily modifying those skills when they needed refinement, according to Anthropic.

A Chinese-speaking group's automated program

Anthropic also describes an espionage operation attributed to a Chinese-speaking group tracked as GTG-10007, where Claude was used "as the engineering and orchestration layer of a coordinated offensive program involving a variety of tasks." Those tasks, per Anthropic, included intrusion attempts against production systems; reconnaissance of foreign-government networks across the Middle East, Europe, and Southeast Asia; a standing vulnerability-research and exploit-development effort against major endpoint-security products; malware development; and building an intelligence-collection platform.

According to Anthropic, GTG-10007 ran autonomous vulnerability-research workflows while human operators were away, and those workflows uncovered multiple previously unknown vulnerabilities in a major security product. The automated effort also delivered "working exploits for several families of network and security appliances," which the actor then leveraged against several government organizations around the world, Anthropic says.

Anthropic says the group's operations targeted around 50 organizations across government, education, retail, energy, technology, healthcare, finance, and manufacturing. It reports confirmed compromises at an education-technology company, a retailer, and a Southeast Asian government agency.

What Anthropic says it found overall

Anthropic says that between December 2025 and August 2026 it recorded various forms of AI misuse, including for cyber and influence operations, surveillance, scams, development of biological and conventional weapons, and model distillation. Across that period, it says it disrupted several activities linked to ShinyHunters.

• 1.8 million distinct Android APKs mass-downloaded and scanned for hardcoded secrets
• 34 hours for a suspected ShinyHunters actor to extract authentication data and obtain more than 2,100 Azure AD authentication tokens
• Those tokens spanned over 40 separate corporate Microsoft tenants
• 1TB of data stolen from a technology provider
• Roughly 200 downstream customers affected in a SaaS provider breach
• More than 20 government, defense, diplomatic, intelligence, and foreign-policy entities targeted by Midnight Blizzard
• Around 50 organizations targeted in the GTG-10007 operation

Anthropic says it banned the threat actors' accounts and disrupted their use of Claude for harmful activity. It also says it adjusted its guardrails based on what it observed, added measures intended to detect future misuse faster, and contacted authorities, industry partners, and victims.

The mechanics behind the automation

What stands out in Anthropic's account is not any single intrusion but the operating model behind them. In the ShinyHunters case, the workflow ran on ten AWS EC2 workers that pulled apps from multiple stores, decompiled them, and checked for embedded secrets — a setup that treats app-store inventory as a target list. Verified hits were routed to a Telegram group split into more than 100 source types, suggesting a pipeline built to sort and act on findings at volume rather than to hunt one target at a time.

The GitHub leg of that operation shows the same pattern: automated collection of organization email addresses, then their use to obtain Personal Access Tokens. Anthropic says those two pipelines supplied initial-access credentials for the bulk of the actor's confirmed breaches. The carding shop at policenationale[.]cc, meanwhile, shows the same actor running a monetization operation alongside the intrusion work — selling stolen payment-card records, full cardholder information, and an interactive map of victim addresses under the guise of French police.

For Midnight Blizzard, the automation took a different shape. Anthropic describes AI-driven workflows built around Claude Code skills, with a human operator stepping in mainly to refine those skills. The rebuilt-on-detection feedback loop points to persistence that adjusts as defenses respond, rather than a fixed malware sample that defenders can fingerprint once.

GTG-10007's case leans on autonomy in a different direction again: vulnerability research that continued while operators were away, surfacing unknown flaws in a major security product and producing working exploits for several families of network and security appliances.

Bans, guardrails, and notifications

Anthropic's response, as described in the report, follows a familiar playbook for AI developers whose models are targeted: ban the accounts, harden the guardrails, watch for the next attempt, and loop in outside parties. The company says it adjusted its guardrails based on the observed malicious use, added measures to detect future misuse faster, and contacted authorities, industry partners, and victims.

That response covers a wide range of actors. ShinyHunters is described as financially motivated, while Midnight Blizzard and GTG-10007 are described as state-linked espionage operations. The operations Anthropic says it disrupted span credential harvesting, bulk data theft, malware development, phishing, vulnerability research, and intelligence collection — and in every case, the company attributes a meaningful share of the work to Claude rather than to the humans directing it.

What it could mean for defenders

Reported by a single company describing activity it says it observed and disrupted, the account leaves open questions that independent verification would need to resolve. What it does suggest, if accurate, is a shift in the economics of intrusion. Operations that once required teams and weeks are described as running on automated pipelines that finish in hours: 34 hours to pull more than 2,100 Azure AD tokens from over 40 tenants, less than three hours to go from one stolen developer token to full administrative control.

For security teams, that compression is the part worth sitting with. Detection and response playbooks built around human-paced adversaries assume a window — time to notice anomalous access, time to revoke credentials, time to contain damage. Anthropic's account describes windows measured in single-digit hours, sometimes with AI agents doing nearly all the work. Organizations that lean on credentials, cloud tenants, and third-party providers may want to revisit how quickly they can rotate secrets, revoke tokens, and isolate affected tenants.

There's a second implication for anyone shipping software: if pipelines can decompile 1.8 million apps and scan for hardcoded secrets at scale, then secrets embedded in app binaries are a durable liability. The same question applies to tokens and API keys that, once stolen, become initial access for further breaches. Anthropic's report doesn't settle how widespread these techniques are, but it does describe what a motivated actor can build when an AI model sits at the center of the workflow.