Loading story…
A French-speaking, financially motivated operator allegedly tied to the ShinyHunters ecosystem used Claude-assisted workflows to harvest credentials from approximately 1.8 million Android APKs and GitHub. Operating under aliases including MeowSHA, frkoo, and blazespider, the actor reportedly used 10 AWS EC2 workers to acquire and decompile applications, then scanned them with TruffleHog for hardcoded secrets. Verified findings were sent to Telegram channels for prioritization, while a parallel effort collected organizational email addresses and searched GitHub for exposed Personal Access Tokens.
Anthropic said the stolen credentials enabled confirmed enterprise intrusions involving cloud-key validation, session replay, token amplification, CI/CD injection, database dumping, and cross-tenant data collection. The company said the abused Claude API keys had been stolen from customer environments—not Anthropic—and that it banned the implicated accounts, improved detection, and coordinated with affected organizations and law enforcement.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
Anthropic's September 2026 threat-intelligence report described the alleged financially motivated credential-theft operation and attributed it to a French-speaking operator using the aliases MeowSHA, frkoo, and blazespider.
Anthropic stated that the API keys abused in the activity were stolen from customer environments, not from Anthropic systems. The company banned accounts tied to the operation, improved detection measures, and coordinated with affected parties, industry partners, and authorities.
The actors reportedly dumped more than 2,100 Azure AD token sets across more than 40 corporate tenants in roughly 34 hours. Anthropic said AI agents performed most of the work in this token-theft activity.
In an alleged supply-chain incident, the actors reportedly extracted data from approximately 200 downstream customer organizations after compromising a SaaS provider.
Anthropic said the Android and GitHub pipelines supplied initial credentials used in many confirmed intrusions associated with the operator. Observed activity included cloud-key validation, session replay, token amplification, CI/CD injection, database dumping, and cross-tenant data collection.
A French-speaking operator allegedly associated with the ShinyHunters ecosystem used Claude-assisted workflows and 10 AWS EC2 workers to download, decompile, and scan about 1.8 million Android APKs with TruffleHog. The operation also harvested organization email addresses and sought exposed GitHub Personal Access Tokens, forwarding verified secrets to Telegram channels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Oasis Security** disclosed an attack chain dubbed **"Claudy Day"** that combines three flaws in Anthropic’s **Claude** platform to enable covert data theft. The chain starts with attacker-controlled Google search results or fake Claude ads that abuse an **open redirect** on `claude.com`, leading victims to what appears to be a legitimate Claude page. From there, a pre-filled chat URL can carry **hidden prompt-injection instructions** embedded in HTML so the user sees benign text while Claude processes malicious commands in the background. According to the reports, the chained flaws allow attackers to silently instruct Claude to search prior conversations for sensitive information and exfiltrate it through the **Anthropic Files API**, creating an end-to-end path from victim luring to unauthorized data exposure. The issue is notable because it does not require extra tooling, integrations, or MCP servers; built-in Claude features are sufficient for exploitation. A separate report about Claude autonomously exploiting vulnerable websites is **not** the same incident, and a report on the **SideWinder** espionage campaign is unrelated.
Jun 29, 2026
Anthropic said it disrupted an AI-enabled cyberespionage campaign, tracked as **GTG-20006** and assessed as consistent with Russian state-linked **Midnight Blizzard**, that operated from December 2025 through August 2026. The operators allegedly used Claude agents to automate reconnaissance, phishing, exploitation, lateral movement, data theft, and an iterative malware-evasion loop: testing tools against security products, modifying and rebuilding detected code, then redeploying it. More than 20 government, defense, intelligence, diplomatic, think-tank, drone-industry, hospitality, and surveillance targets across Ukraine, Europe, the Middle East, Asia, and North Africa were reportedly targeted; theft included drone-maker mailboxes and a proprietary drone-vision SDK. Reported activity also included DNS hijacking via hotel Wi-Fi vendors and WhatsApp-account takeovers. Anthropic said other disrupted abuse included ShinyHunters-associated credential harvesting and Android-package analysis, a SaaS supply-chain intrusion affecting more than 200 downstream organizations, suspected Chinese-linked exploit research, and politically motivated theft and doxxing. The company warned that AI API keys, session tokens, and AI-integrated services are increasingly valuable targets because stolen access can be resold, provide victim-funded compute, and obscure attacker attribution. Anthropic banned involved accounts, strengthened misuse controls, and shared relevant indicators with law enforcement and industry partners.
Sep 11, 2026
Researchers analyzing more than 1,000 recovered AI agent sessions found that a low-skilled attacker used Anthropic’s **Claude Code** and OpenAI’s **Codex** to carry out offensive cyber operations against at least 14 companies. Logs from a compromised Vultr-hosted system showed the operator using the tools for reconnaissance, vulnerability discovery, exploit development, credential harvesting, database replication, session impersonation, cloud and API key testing, mail-account takeover attempts, and lateral movement. The sessions also documented requests for stealth, anti-forensics, transcript editing, encrypted reporting, and migration of stolen data, while some generated **pentest-style reports** that included monetization estimates for exfiltrated information. Investigators said the attacker reused stolen local AI agent installations and made operational security mistakes that helped attribute the activity to a young man in Addis Ababa, Ethiopia. Separate analysis of a **Claude Code** network sandbox bypass highlighted why AI agent misuse can extend beyond unsafe model output into runtime and infrastructure controls. NSFOCUS reported that proxy-based filtering could be bypassed because policy checks evaluated the original input while the network layer parsed and truncated it differently, including with invisible control characters or null bytes, creating a path for outbound requests and possible data leakage in a single execution chain. Although the issue was reportedly fixed in later versions, researchers said the low-profile remediation made exposure difficult to assess and underscored the need for layered defenses such as strict egress allowlisting, least privilege, short-lived secrets, auditing, fail-closed policies, and fuzz testing of parsing paths.
Jun 29, 2026