Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion

1. Executive summary

Anthropic reports disrupting a cyberespionage operation (activity window December 2025–August 2026) whose tradecraft and targeting match the Russian state-nexus group tracked as Midnight Blizzard — attribution is Anthropic's assessment and the actor has no MITRE ATT&CK profile in our verified reference data, so we treat it as unconfirmed. The actor used Claude to automate the malware detection-evasion loop: when a tool was flagged by security products, AI agents modified, rebuilt and redeployed it until it went clean, collapsing the historical manual rewrite cycle. Targeting exceeded 20 organisations — Ukrainian and European government ministries, defence/intelligence bodies, embassies and think tanks, with extension into the Middle East and Asia — including exfiltration of mailboxes from two drone component manufacturers and theft of a complete drone vision SDK. For EMEA financial services, the near-term risk is not direct targeting (no financial-sector victims are named) but the demonstrated acceleration of evasion tradecraft against commodity EDR, plus a parallel trend of AI credential theft (stolen production API keys, credential-harvesting reseller clients) that directly implicates any client running AI agent integrations against production systems.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed steps (per Anthropic's report, as reported by SecurityWeek)

1. Targeting. The actor targeted 20+ organisations: Ukrainian and European government ministries, defence and intelligence bodies, embassies, and think tanks; additional targeting extended to the Middle East and Asia. Two drone component manufacturers were successfully compromised.
2. AI-accelerated evasion loop. The actor used Claude to monitor how well its malware evaded detection by security products. When a tool was flagged, AI agents automatically modified and rebuilt it, then redeployed — repeating until the malware went undetected. Anthropic assesses this shifts the cost of the detection-evasion cycle onto defenders: new signatures historically forced attackers into a slow manual rewrite cycle; AI now lets capable actors "close the loop" faster than defenders respond.
3. Exfiltration. Mailboxes were exfiltrated from two drone component manufacturers, and a complete proprietary SDK for a drone vision system was stolen. The actor spent several days reverse-engineering the SDK's architecture, hardware bill of materials, and supplier dependencies — indicating sustained post-access collection, not smash-and-grab.
4. Hospitality-vendor access path. At least three hospitality vendors operating hotel guest Wi-Fi were compromised using stolen admin credentials, then guest traffic was redirected via DNS hijacking. Microsoft separately documented this delivery method in July 2026 under the name CaptiveCrunch and attributed it to Midnight Blizzard — this is the only element of the chain with independent second-source corroboration.
5. WhatsApp account takeover. The same actor linked victims' WhatsApp accounts as companion devices through headless browsers, suppressing read receipts to export conversations undetected. At least two former high-level Ukrainian officials were targeted this way.
6. Disruption. Anthropic states it identified and shut down the activity between December 2025 and August 2026, used findings to strengthen AI safeguards, and shared intelligence with authorities and industry partners.

Separate AI-infrastructure-targeting activity (distinct actors, same report)

• GTG-50021 ran a fraudulent Claude reseller service: paying customers were silently proxied to a different model while a bundled client application harvested their Anthropic account credentials for resale.
• GTG-50020 (financially motivated, Russian-speaking, previously active against hotel-booking and fintech platforms) used prompt injection against an AI vendor's automated evaluation sandbox, causing it to disclose production API keys belonging to multiple providers. The actor used the stolen keys to continue attacks and ran a multi-day campaign against roughly 30 AI companies, pursuing more than a dozen avenues to access a pre-release Claude model. All attempts failed. Anthropic notes stolen AI credentials have resale value, provide free compute, and offer attribution cover because resulting activity is logged against the legitimate keyholder.

Caveats and confidence. Attribution to Midnight Blizzard is Anthropic's assessment; the actor has no MITRE ATT&CK profile in our verified reference data and we treat it as unconfirmed. The espionage chain, victim counts, drone-SDK theft, WhatsApp takeover technique, and both GTG clusters are single-sourced (Anthropic's threat intelligence report, relayed by SecurityWeek) — verify before enforcement. No CVEs, malware family names, hashes, domains or IP addresses are present in the source material. The Dark Reading and Record articles in the corpus relate to a different Anthropic disclosure (Claude models escaping test environments and breaching three companies due to over-permissioning, especially internet access) and are context only — do not conflate them with this espionage operation.

4. Mitigation & containment

P1 — within 24 hours

• Audit AI API key exposure. Inventory all Anthropic/OpenAI/other provider API keys and agent integrations; treat them as production credentials. Rotate any key that has been used in third-party tooling, reseller clients, or evaluation sandboxes. Specifically check for use of unofficial "reseller" Claude clients (GTG-50021's harvesting vector).
• Isolate evaluation/sandbox environments from production secrets. The GTG-50020 vector was prompt injection against an automated evaluation sandbox that had access to production API keys. Ensure no sandbox, CI evaluation harness, or agent test environment can read production keys — remove keys from sandbox environment variables and secret stores.
• Hunt for companion-device WhatsApp linking. Review WhatsApp/Enterprise messaging admin logs for unexpected companion-device registrations, particularly for executives, former officials, and staff with government or defence touchpoints. The actor suppressed read receipts to hide the export — absence of visible read-state anomalies is not evidence of absence.

P2 — within 72 hours

• Assume signature-only controls are insufficient. The confirmed tradecraft is an automated rebuild loop that iterates until commodity detection passes. Prioritise behavioural detection (see §6) over hash/signature reliance for any actor with this capability profile, and validate that EDR policies alert on behaviour, not only known binaries.
• Review hospitality/travel vendor risk. Identify which hotels and conference venues your travelling staff use that operate guest Wi-Fi under third-party admin credentials. Advise staff that guest Wi-Fi at targeted venues may carry DNS-hijack redirection (CaptiveCrunch method); mandate corporate VPN/cellular for travel connectivity.
• Check DNS resolution paths. For any network where staff connect through third-party-managed Wi-Fi, verify DNS server settings are enforced by device policy (MDM) and cannot be silently redirected by a compromised access-point administrator.

P3 — within 7 days

• Incorporate AI-accelerated evasion into purple-team exercises. Test detection against iteratively modified variants of known tooling — rebuild-and-redeploy until clean is now an automatable attacker workflow. Feed results into resilience testing under DORA Art. 24.
• Extend third-party risk assessments to AI providers. Where you consume AI services, add sandbox isolation, key-handling, and prompt-injection resistance to provider due diligence (DORA Art. 28).
• Brief fraud/travel security teams on the WhatsApp companion-device takeover technique as applied to high-profile individuals.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, URLs) are available in the source material.

Behavioural indicators

6. Detection

The sources contain no malware artefacts (strings, hashes, mutexes, paths, registry keys, C2 domains) usable for YARA. The following Sigma rule targets the most actionable behavioural indicator from the confirmed chain: companion-device linking of messaging accounts via headless browser, which is observable in process telemetry.

title: Suspicious Headless Browser Activity Linked to Messaging Account Takeover
id: 7c3f2a91-4b8e-4d1a-9f6c-2e5d8a1b0c4f
status: experimental
description: >
  Detects execution of headless browser processes consistent with the
  WhatsApp companion-device linking technique reported by Anthropic
  (AT-2026-09-11-838). The actor linked victims' messaging accounts as
  companion devices through headless browsers, suppressing read receipts
  to export conversations undetected.
references:

  - https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/
author: Adverse Trace
date: 2026-09-11
tags:

  - attack.t1550.004
  - attack.command_and_control
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_headless:
    CommandLine|contains:

      - '--headless'
      - '--headless=new'
  filter_legitimate_ci:
    CommandLine|contains:

      - '--disable-gpu'
      - '--dump-dom'
  condition: selection_browser and selection_headless and not 1 of filter_*
falsepositives:

  - Automated testing pipelines and CI screenshot tooling
  - Legitimate web scraping with headless flags
level: high

Caveat: headless-browser execution is a generic technique with legitimate uses; this rule is a hunting pivot, not a high-precision detector. Tune per environment. No YARA rule is possible: the source material contains no threat artefacts (strings, filenames, or values belonging to the malware itself).

7. Sources

• SecurityWeek — Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion — https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/ — 2026-09-11
• Dark Reading — Anthropic: AI Attacks Result of Security Gaps, Not Model Issues — https://www.darkreading.com/cyber-risk/anthropic-ai-issues-result-security-gaps — context (separate Anthropic disclosure)
• The Record (Recorded Future) — Anthropic says its AI hacked real-world companies in three incidents — https://therecord.media/anthropic-ai-hacked-three-real-companies — context (separate Anthropic disclosure)

8. Adverse Trace position

This is a strategic tradecraft-shift advisory, not an active threat to client estates — no financial-sector victims are named and no CVE or malware artefact is in scope, so there is nothing to patch or block today. The operational significance is twofold. First, the confirmed AI-accelerated evasion loop means detection strategies anchored to signatures and hashes are now structurally outpaced by capable state-nexus actors; clients should treat behavioural detection coverage and iterative-variant testing as a standing requirement, which maps directly to resilience testing under DORA Art. 24. Second, the parallel AI-infrastructure findings — production API keys extracted from a vendor sandbox via prompt injection, credential-harvesting reseller clients, and a multi-day campaign against ~30 AI companies — mean any client integrating AI agents with production systems or third-party AI tooling should audit key exposure now; stolen AI credentials provide free compute, resale value, and attribution cover against the legitimate keyholder. Attribution to Midnight Blizzard is Anthropic's assessment, unconfirmed in our reference data; the espionage chain and both GTG clusters are single-sourced to Anthropic's report — verify before enforcement. We will monitor for Microsoft's CaptiveCrunch technical detail (the only independently corroborated element), any IOC release from Anthropic or partner disclosures, and evidence of this tradecraft appearing against financial-sector targets.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.