Anthropic Reports Increasingly Autonomous AI Misuse in Cybercrime and Espionage
Report discovered via Awesome Annual Security Reports.
Summary
Anthropic’s September 2026 report describes disrupted Claude misuse spanning espionage, credential theft, fraud and surveillance. It reports growing use of autonomous attack workflows and stolen AI credentials between December 2025 and August 2026.
Key points
- Anthropic reports that threat actors increasingly delegated reconnaissance, exploitation and data theft to multi-agent workflows, while humans retained important targeting and monetization decisions.
- GTG-20006, whose attribution Anthropic says is consistent with links to Midnight Blizzard, used AI workflows to rebuild detected malware, automate phishing and support espionage against government and defense targets.
- Suspected ShinyHunters affiliates harvested exposed credentials at scale; one operator scanned 1.8 million Android APKs using TruffleHog and routed verified secrets to Telegram.
- Anthropic says GTG-10007 combined parallel intrusion workflows with autonomous firmware analysis and exploit testing, targeting roughly 50 organizations and validating previously unknown vulnerabilities in its lab.
- GTG-50020 stole production API keys through malicious instructions injected into an AI vendor’s evaluation sandbox. Anthropic says attempts to obtain a pre-release Claude model failed and its own systems were not compromised.
- According to Anthropic, lone hacktivist GTG-50029 gained internal access to at least 14 of 42 tracked targets, stole an estimated 12–26 GB of database dumps, and built the fafsearch doxxing platform.
- The report also documents deceptive influence networks, surveillance and fraud. Anthropic says it disrupted the reported activity, strengthened safeguards, and shared intelligence with authorities and industry partners where appropriate.
Article Details
- Publisher
- Anthropic
- Report Period
- 2025-12 through 2026-08
- Scope
- Selected case studies of Claude misuse across cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation.
- Key Statistics
- GTG-50014 operator frkoo ran a credential-harvesting pipeline across 10 AWS EC2 workers, downloading and analyzing 1.8 million distinct Android APKs.
- One suspected ShinyHunters affiliate extracted data from roughly 200 downstream customer organizations and dumped over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours.
- GTG-50029 gained internal access to at least 14 of 42 tracked target entities and exfiltrated an estimated 12–26 GB of database dumps.
- GTG-50020 attacked roughly 30 AI companies in about four days; its attempts to obtain a pre-release Claude model all failed.
- Anthropic attributed over 151 million observed exchanges between May and July 2026 to Alibaba distillation activity.
- Recommendations
- Treat AI API keys and session tokens with the same security rigor as production credentials.
- Treat agent integrations, sandboxes, proxies, and resellers as part of the organizational attack surface.
- Purchase AI access only through authorized channels rather than unknown intermediaries offering discounted access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | awstore[.]cloud | Domain listed as an IOC for GTG-50021 fraudulent AI resale and credential harvesting. |
| DOMAIN | docs-viewer[.]org | Infrastructure listed as an IOC for GTG-20006 espionage operations. |
| DOMAIN | fafwatch[.]xyz | GTG-50029 actor-registered domain associated with doxxing activity. |
| DOMAIN | fiftystates[.]news | Fabricated news outlet in the GTG-54002 commercial influence-as-a-service network. |
| DOMAIN | kiro[.]cheap | Domain listed as an IOC for GTG-50021 fraudulent AI resale and credential harvesting. |
| DOMAIN | malaysiapulse[.]com | Actor-controlled fabricated news front in the GTG-84005 election-manipulation operation. |
| DOMAIN | ms365-device[.]com | Infrastructure listed as an IOC for GTG-20006, which operated device code phishing and token theft. |
| DOMAIN | ms365-live[.]com | Infrastructure listed as an IOC for GTG-20006 espionage operations. |
| DOMAIN | naijapulse[.]org | Fabricated news outlet in the GTG-54002 commercial influence-as-a-service network. |
| DOMAIN | on-pssword[.]com | Domain listed among GTG-50014 operational indicators. |
| DOMAIN | signin-1psswoord[.]com | Domain listed among GTG-50014 operational indicators. |
| DOMAIN | sys-tools[.]cfd | Domain listed as an IOC for GTG-50021 fraudulent AI resale and credential harvesting. |
| DOMAIN | wa-connect[.]eu | Infrastructure listed as an IOC for GTG-20006, which also compromised WhatsApp accounts. |
| HOSTNAME | autoshop[.]policenationale[.]cc | Actor-operated storefront selling stolen payment-card records and cardholder personal information. |
| HOSTNAME | frntrs-analytics-863060591218[.]europe-west1[.]run[.]app | Cloud Run origin behind GTG-50029 browser-C2 infrastructure. |
| HOSTNAME | frntrs-analytics[.]dedyn[.]io | Actor-controlled BeEF browser-C2 hostname used by GTG-50029. |
| HOSTNAME | iymkjuzymkapovrntoxy[.]supabase[.]co | Specific hosted infrastructure identified as a GTG-50021 IOC. |
| HOSTNAME | pdfviewer2024[.]b-cdn[.]net | Specific hosted hostname identified as a GTG-20006 IOC. |
| HOSTNAME | soraki-proxy[.]20245aad98d27b1b1a2f0f103e1d7ee0[.]workers[.]dev | Specific hosted infrastructure listed as a GTG-50014 IOC. |
| HOSTNAME | update[.]stuseamandesilt[.]org | Host listed among GTG-20006 operational indicators. |
| IPV4 | 162[.]128[.]129[.]106 | GTG-50014 attacker egress IP observed from 2026-02-20 through 2026-03-10. |
| IPV4 | 178[.]16[.]54[.]141 | GTG-50020 attacker egress IP observed from 2026-05-21 through 2026-06-16. |
| IPV4 | 23[.]88[.]118[.]216 | IP identified as infrastructure supporting the GTG-84005 influence platform. |
| IPV4 | 34[.]156[.]199[.]132 | GTG-50029 exfiltration endpoint in a hijacked GCP project. |
| IPV4 | 34[.]156[.]95[.]176 | GTG-50029 exfiltration endpoint in a hijacked GCP project. |
| IPV4 | 37[.]27[.]103[.]22 | GTG-50020 attacker egress IP observed from 2026-05-26 through 2026-06-13. |
| IPV6 | 2a04:cec0:1185:34f2:a150:7081:caed:448e | GTG-50014 attacker egress address observed from 2026-04-06 through 2026-04-07. |
| SHA256 | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | Artifact hash listed in the GTG-20006 malware indicators. |
| SHA256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | Artifact hash listed in the GTG-20006 malware indicators. |
| URL | hxxps[:]//s3[.]eu-central-1[.]s4[.]mega[.]io/fuckyoubasil/ | Specific cloud-storage resource identified as a GTG-50014 exfiltration location. |
MITRE ATT&CK
T1078 · Valid AccountsMultiple actors used stolen or exposed credentials to access victim systems and cloud environments.T1098.001 · Additional Cloud CredentialsGTG-50014 operators created cloud API keys in victim accounts to preserve access after credential rotation.T1098.005 · Device RegistrationGTG-20006 automated registration of actor-controlled devices into victim organizational tenants to maintain access.T1114.002 · Remote Email CollectionGTG-20006 bulk-exported compromised mailboxes, including those of drone component manufacturers.T1190 · Exploit Public-Facing ApplicationActors exploited public-facing applications; GTG-50029 successfully exploited a WordPress re-installation race condition on at least four websites.T1505.003 · Web ShellGTG-50029 implanted a webshell hidden among font assets on a compromised web server.T1537 · Transfer Data to Cloud AccountGTG-50029 used exfiltration endpoints in hijacked GCP projects to receive stolen material.T1539 · Steal Web Session CookieGTG-50020 captured verified sessions through reverse-proxy KYC phishing; other actors stole authenticated session tokens.T1555.003 · Credentials from Web BrowsersGTG-20006 used a credential-stealing tool targeting browser password stores.T1562.001 · Disable or Modify ToolsGTG-20006 payloads froze security updates to prevent retrieval and execution of new malware detection signatures.T1567.002 · Exfiltration to Cloud StorageGTG-50014 moved stolen material to consumer cloud storage, including explicitly identified exfiltration storage resources.T1583.001 · DomainsGTG-20006 used AI workflows to research and register domains for phishing infrastructure.T1595 · Active ScanningActors conducted broad scanning and fingerprinting of internet-facing email, remote access, and other systems.
People
frkooFrench-speaking suspected ShinyHunters affiliate operating a credential-harvesting pipeline and stolen-card storefront; also used the aliases MeowSHA and blazespider.JackPoterzHandle of a Russian-speaking GTG-20006 operator whose tradecraft and targeting Anthropic assessed as consistent with Russian state-nexus espionage.kl1zyAlias of a GTG-50021 member involved in fraudulent AI resale and credential harvesting.Maia SanduTarget of fabricated defamatory claims amplified by a Russian state-media editorial operation before Moldova's 2025 parliamentary election.Maryam RajaviNCRI president whose ten-point plan was promoted using undisclosed synthetic avatars in the MEK/NCRI-aligned influence operation.
Threat Actors
GTG-10002Previously reported group cited as developing and using its own autonomous attack framework.GTG-10007Chinese-speaking espionage operators conducting intrusions, autonomous vulnerability research, malware development, and intelligence collection.GTG-20006Espionage actor targeting government, diplomatic, defense, and drone supply-chain entities. Anthropic described attribution as consistent with public reporting linking the actor to Midnight Blizzard.GTG-30005Iran-nexus actor using Claude for reconnaissance and targeting recommendations against US naval forces, and development for domestic surveillance systems.GTG-50014Financially motivated clusters suspected to be ShinyHunters affiliates, conducting credential theft, intrusions, data theft, and extortion.GTG-50020Russian-speaking financially motivated actor conducting extortion, AI evaluation sandbox attacks, production API key theft, and phishing.GTG-50021Russian- and Ukrainian-speaking group running fraudulent AI resale that installed credential harvesters and resold stolen credentials.GTG-50029French-speaking hacktivist actor conducting intrusions, credential interception, browser-C2 operations, data theft, and doxxing.Midnight BlizzardPublic reporting linked GTG-20006 to this actor; Anthropic said its attribution was consistent with that reporting.ShinyHuntersCollective whose suspected affiliates were investigated under GTG-50014; affiliation was presented as suspected.
Malware
CloudSyncSvc- **Windows malware**: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc;DarkSword- **iOS malware**: DarkSword, an iOS exploit chain.GiftDrop- **Android malware**: GiftDrop, a rebranded GiftsExpress Android surveillance RAT;GiftsExpress- **Android malware**: GiftDrop, a rebranded GiftsExpress Android surveillance RAT;MiniPlasma- **Windows malware**: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc;PowerChrome- **Windows malware**: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc;Shadow C2- **Windows malware**: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc;WUEngine- **Windows malware**: PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc;
Vendors
Products
ClaudeOver the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity.Claude CodeThe human actor engaged primarily to modify Claude Code skills that drove the workflows when they needed to be refined.KimiKimi and collects exchanges for model trainingLiteLLMaccounts on novice service providers with poor security to escape their containers; prompt injection of LiteLLM or OpenClaw deployments; and more.Microsoft 365 Apps for EnterpriseThe actor continued to develop a cloud email espionage platform that in part used “Embassy Kit,” the actor’s framework for managing device code phishing, to operate a Microsoft 365 token theft campaign.WhatsAppThe actor also took over victims’ WhatsApp accounts, using a platform of headless browsers to link victim accounts as companion devices.WordPresssignature technique to initially access their target systems was exploiting a previously undocumented WordPress re-installation race condition that created a rogue administrator account without valid credentials.
Tools
BeEF| frntrs-analytics.dedyn[.]io | BeEF browser-C2 hostname (deSEC dynamic DNS, actor-held API token) | 2026-05-13 | 2026-06 |Deadshotmaintain an AI persona named “Deadshot” hosted on their own private platform.Embassy KitThe actor continued to develop a cloud email espionage platform that in part used “Embassy Kit,” the actor’s framework for managing device code phishing, to operate a Microsoft 365 token theft campaign.fafsearchThe actor’s signature tool was “fafsearch,” a purpose-built doxxing platform.fake_news_3.pycustom software program named “fake_news_3.py” to connect directly to Claude, whichPentAGIPublicly available offensive agent frameworks, like PentAGI, reproduce much of the same scaffolding for anyone who downloads them.TruffleHogThis pipeline mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, decompiled them, and scanned for hardcoded secrets with TruffleHog.Viktor(“Viktor”) across actors coordination substrate
Countries
Bangladeshrural BangladeshCentral African Republicoperation in the Central African RepublicChinaWe identified and investigated a sustained espionage operation, tracked as GTG-10007, conducted by Chinese-speaking operators likely residing in Changsha in China’s Hunan province.IranThis report details nine of those cases. They originated in Russia, Iran, Turkey, andKenyaSeptember 2025 vote, and a pro-government operator in Kenya prepared fakeMalaysiamanipulation platform that primarily targeted users in Malaysia. The network consistedRussiaThis report details nine of those cases. They originated in Russia, Iran, Turkey, andUAEGTG-84002: Disrupting a UAE-directed influenceUkraineembassies and diplomatic missions, think tanks, and defense-industrial companies, concentrated in Ukraine and Europe but extending to the Middle East and maritime related government agencies in Asia.United Statesspecifically focusing on the United States, Brazil, France, and the Democratic
Industries
DefenseThey ran operations attacking military intelligence targets in Ukrainian and European governments, as well as diplomatic and defense organizations and individuals connected to US foreign policy.Educationof mail records from at least eight organizations including a national prosecutor office, a military education institute, and a regional intergovernmental organization.EnergyAt an energy company, the operators claimed that they could remotely control the charging current of electric-vehicle chargers installed in customers’ homes.financeThe actor targeted roughly fifty organizations, spanning education, retail, energy, technology, healthcare, finance, manufacturing, as well as multiple government agencies globally.Governmenttool that targets browser password stores, a phishing platform designed to mimic priority targets like government organizations, and an administrative console used to manage compromised accounts.HealthcareThe actor targeted roughly fifty organizations, spanning education, retail, energy, technology, healthcare, finance, manufacturing, as well as multiple government agencies globally.HospitalityNot all targets were direct: to reach their targets indirectly, the actor compromised at least three hospitality vendors that operate hotel guest WiFi.ManufacturingThe actor targeted roughly fifty organizations, spanning education, retail, energy, technology, healthcare, finance, manufacturing, as well as multiple government agencies globally.Retailweeks to conduct secondary attacks, which targeted other organizations including compromising a French retail chain and probing a Web3 identity platform.TechnologyA common theme of the targeting was Ukraine and military drone technology providers and supply chains.