Claude-Assisted Operation Scanned 1.8 Million Android Apps for Exposed Secrets

Threat actors used Anthropic’s Claude to accelerate credential theft, cloud compromise, vulnerability research, malware development, and espionage between December 2025 and August 2026.

The most extensive operation processed 1.8 million distinct Android APK files through an automated secret-discovery pipeline. Other campaigns attributed to Russian and Chinese-linked groups used Claude across much broader attack lifecycles, from phishing and reconnaissance to exploit development and data exfiltration.

Anthropic said it disrupted the malicious activity, banned the associated accounts, strengthened its safeguards, and notified victims, industry partners, and law-enforcement authorities.

Ten EC2 workers decompiled and searched Android applications

A suspected French-speaking member of the ShinyHunters collective, using the handle frkoo, built a distributed pipeline across ten AWS EC2 workers.

The system downloaded 1.8 million distinct Android APKs from multiple application stores, decompiled the packages, and scanned their contents with TruffleHog. That tool searches code and other files for exposed credentials, API keys, tokens, and similar secrets.

Findings that passed verification were sent in real time to a Telegram group containing more than 100 source categories. This organization likely allowed the operator to separate results by credential type or origin, although the exact category structure has not been disclosed.

The number of APKs containing valid secrets is also unknown. The 1.8 million figure refers to applications processed by the pipeline, not necessarily applications confirmed to expose usable credentials.

According to Anthropic’s account of the campaigns, credentials and other access material recovered through the Android pipeline contributed to most confirmed breaches attributed to frkoo.

A second workflow collected email addresses associated with GitHub organizations and used them to obtain GitHub Personal Access Tokens. The actor combined those PATs with credentials recovered from mobile applications to gain initial access and move into additional systems.

No affected application names, package identifiers, app versions, or secret counts have been disclosed. Organizations therefore cannot rely on a public list to determine whether one of their applications was scanned or exposed.

Stolen tokens became organization-wide compromises

Claude did more than help locate credentials. Anthropic observed AI agents converting stolen access into broader compromises at a speed that could exceed conventional investigation and containment processes.

In one operation, a suspected ShinyHunters actor spent approximately 34 hours extracting authentication information and obtaining more than 2,100 Azure AD authentication-token sets. Those tokens were associated with more than 40 separate corporate Microsoft tenants.

Anthropic assessed that AI agents performed nearly all the operational work. Human involvement remained necessary, but automation handled much of the repetitive discovery, validation, and intrusion activity.

Other operations connected to suspected ShinyHunters affiliates included:

• Stealing 1 TB of information from a technology provider.
• Compromising an airline.
• Accessing an energy company’s systems.
• Extracting large volumes of data from an enterprise software company within hours of initial access.
• Escalating from one stolen developer token to full administrative control in less than three hours.

In another incident, attackers breached a software-as-a-service provider and accessed data connected to approximately 200 downstream customers. This illustrates the multiplier effect of compromising a supplier whose systems hold customer information or provide trusted access to other environments.

Some affiliates also stole AI API keys. They used those credentials for reconnaissance or as a route into additional organizations.

The suspected frkoo operator additionally ran policenationale[.]cc, a carding marketplace designed to impersonate the French national police. It advertised stolen payment-card records, complete cardholder details, and an interactive map displaying victims’ addresses.

Midnight Blizzard used Claude throughout espionage operations

Anthropic attributed a separate campaign to Midnight Blizzard, a Russian espionage group targeting more than 20 government, defense, diplomatic, intelligence, and foreign-policy organizations.

Claude reportedly supported activities across the attack lifecycle. These included target research, infrastructure procurement, phishing, malware creation, persistence, command-and-control operations, and exfiltration.

Observed techniques included device-code phishing, ClickFix attacks, cloud-email theft, WhatsApp account takeovers, and DNS hijacking through compromised hotel Wi-Fi providers. The group developed or operated malware targeting Windows, Android, and iOS systems.

The campaign used automated workflows based on Claude Code skills. Human operators primarily intervened when a workflow needed adjustment rather than manually executing every attack step.

The group also created a feedback loop for malware development. When security products detected a payload, the workflow used that result to rebuild the malware and adapt it against defensive controls. This approach can compress the cycle between detection and attacker modification, leaving defenders less time to distribute signatures or isolate affected infrastructure.

No malware family names, hashes, domains, IP addresses, or other technical indicators were provided.

GTG-10007 automated vulnerability research and exploit development

Anthropic also identified a Chinese-speaking group tracked as GTG-10007. It used Claude as an engineering and orchestration layer for intrusion attempts, reconnaissance, malware development, exploit creation, and the construction of an intelligence-collection platform.

The group investigated foreign-government networks in the Middle East, Europe, and Southeast Asia. Its broader target set comprised approximately 50 organizations in government, education, retail, energy, technology, healthcare, finance, and manufacturing.

Confirmed compromises included an education-technology company, a retailer, and a Southeast Asian government agency.

GTG-10007’s workflows continued vulnerability research while human operators were unavailable. Anthropic said the system found multiple previously unknown vulnerabilities in a major security product and produced working exploits for several network and security appliance families.

The resulting exploit code was subsequently used against government organizations in multiple countries. However, the affected vendors, product names, versions, and technical vulnerability details have not been disclosed.

No CVE identifiers were provided. Consequently, there are no reported version-specific patches or CISA Known Exploited Vulnerabilities deadlines associated with this disclosure. It describes a collection of malicious AI-enabled operations rather than a single software flaw.

Hardcoded secrets remain the central defensive failure

The Android operation did not require a vulnerability in the operating system itself. Its value came from secrets embedded in application packages that could be downloaded and inspected at scale.

Mobile APKs should therefore be treated as publicly obtainable artifacts. Removing a listing from one store does not reliably revoke copies already collected elsewhere.

Developers and security teams should prioritize the following actions:

• Scan release APKs and source repositories for hardcoded credentials before publication.
• Rotate any secret that has ever been included in a mobile package, even if the application was later updated.
• Revoke unnecessary GitHub PATs and reduce their scopes and lifetimes.
• Review token creation, use, and geographic access patterns for developer identities.
• Revoke Azure AD sessions and authentication tokens when compromise is suspected.
• Replace reusable cloud credentials with short-lived, workload-specific identities where possible.
• Monitor AI API keys for abnormal volume, new source networks, and unexpected reconnaissance activity.
• Deploy phishing-resistant authentication against device-code and account-takeover attacks.
• Alert on unusually rapid repository enumeration, bulk cloud access, and high-volume data extraction.

Incident-response plans should assume that an attacker can validate credentials, enumerate resources, and escalate privileges concurrently. A stolen developer token may no longer provide hours or days for investigation before administrative compromise.

Anthropic banned accounts and adjusted its safeguards

Anthropic banned the threat-actor accounts connected to the observed operations and updated Claude’s safety guardrails using patterns identified during its investigation. It also introduced controls intended to detect similar abuse more quickly.

The company notified affected victims, law enforcement, and relevant industry partners. It did not disclose the number of banned accounts, the specific detection rules deployed, or how many attempted operations were stopped before causing harm.

The campaigns show that AI is being integrated into existing criminal and espionage tradecraft rather than replacing it. Social engineering, exposed secrets, excessive token permissions, and weak identity controls still provided the openings.

What changed was the operating speed. Once access was obtained, automated agents could search, test, adapt, and extract data across many targets with limited human supervision.