Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

1. Executive summary

Anthropic's latest AI misuse report (154 pages, covering December 2025–August 2026) documents that both state-sponsored and financially motivated threat actors used Claude models to automate substantial portions of the intrusion kill chain — reconnaissance, exploitation, persistence, and data exfiltration — via multi-agent frameworks rather than simple chatbot queries. The most consequential cluster for EMEA financial services is GTG-20006, a Russian espionage operation with tactical overlap with Midnight Blizzard/APT29/Cozy Bear that targeted 20+ organisations including government and defence entities across Ukraine, Europe, the Middle East, Asia, and North Africa, and used AI to automate development, infrastructure acquisition, phishing, C2 persistence, and exfiltration. Separately, ShinyHunters-affiliated clusters used Claude to scale supply-chain attacks against SaaS providers — one breach of a SaaS vendor cascaded to roughly 200 downstream customer organisations and yielded a session-store dump of over 2,100 Azure AD token sets spanning 40+ corporate tenants in approximately 34 hours, with AI agents performing nearly all of the work. Attribution to named APT groups is Anthropic's own assessment based on tactical overlap; "Generative Threat Groups" has no MITRE ATT&CK profile, so treat all GTG attributions as unconfirmed pending independent corroboration.

2. Regulatory framing

No article is cited for the AI-specific nature of the activity itself; the regulatory hooks above are triggered by the supply-chain and incident-classification facts, not by the use of Claude per se.

3. Technical analysis & attack chain

Confirmed attack-chain elements (per Anthropic's reporting, as covered by the cited sources)

1. Actor onboarding. Threat actors — state-sponsored espionage units (GTG-20006), financially motivated criminals (ShinyHunters affiliates), and individual operators — obtained access to Claude models (Haiku, Sonnet, Opus; Anthropic states its most powerful "Fable/Mythos-class" models were not used except in one distillation case).
2. Multi-agent workflow construction. Actors built customised AI-driven workflows using multi-agent frameworks that executed reconnaissance, exploitation, and data exfiltration — not single-prompt chatbot interactions.
3. Automated kill chain (GTG-20006). The workflow automated: malware/tooling development, infrastructure acquisition, phishing, persistence via command-and-control, and data exfiltration. Per The Register and The Hacker News, this included using AI to rebuild malware after detection — i.e., iterating payloads to stay ahead of defender signatures.
4. Targeting (GTG-20006). 20+ organisations: embassies, think tanks, defence-industrial companies, and government, defence, and intelligence agencies across Ukraine, Europe, the Middle East, Asia, and North Africa.
5. Supply-chain pivot (ShinyHunters affiliate). Breach of a SaaS provider → used the foothold to steal data from ~200 of the SaaS company's customer organisations → conducted a session-store dump of over 2,100 Azure AD token sets spanning 40+ corporate tenants in ~34 hours. AI agents performed nearly all of the work.
6. Credential harvesting at scale (GTG-50014 / "MeowSHA", "frkoo", "blazespider"). A French-speaking suspected ShinyHunters affiliate ran a distributed credential-harvesting pipeline across 10 AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app-store sources, scanned them for hard-coded secrets using TruffleHog, and sent verified findings to a Telegram group.
7. AI supply-chain targeting (GTG-50020). A Russian-speaking financially motivated actor — historically targeting hotel booking and fintech platforms — pivoted to stealing model-provider API keys and unsuccessfully attempting access to pre-release AI models, targeting ~30 AI vendors in a four-day window with similar techniques.
8. Fraudulent AI reseller (GTG-50021). A Russian/Ukrainian-speaking group offered cheap Claude access, silently proxied customer traffic to a different AI model, and installed a credential harvester to siphon Anthropic account credentials for resale to other proxy resellers.
9. WordPress exploitation (GTG-50029). A single French-speaking actor targeted European political parties, media, think-tanks, and their SaaS providers, exploiting a previously undocumented WordPress re-installation race condition to create a rogue administrator account without valid credentials, plus abuse of an exposed search (source text truncates here).
10. Chinese-speaking operator (GTG-10007). Likely based in Hunan province, some identified as undergraduate students at a Chinese university; conducted intrusion attempts against production systems, reconnaissance of foreign-government networks across the Middle East, Europe, and Southeast Asia, vulnerability research and exploit development against major endpoint-security products, and an autonomous vulnerability-research program producing working exploits for previously unknown vulnerabilities in network and security appliances. Targeted ~50 organisations across education, retail, energy, technology, healthcare, finance, manufacturing, and government sectors globally.

Confidence caveats. All GTG designations and their mapping to established actors (e.g., GTG-20006 ↔ Midnight Blizzard/APT29/Cozy Bear) are Anthropic's internal attributions based on tactical and tradecraft overlap, single-sourced to Anthropic's report; "Generative Threat Groups" has no MITRE ATT&CK profile, so treat attribution as unconfirmed. The specific Azure AD token-set figures, APK volume, and target counts are likewise single-sourced to Anthropic's reporting as relayed by the cited outlets. No CVEs, CVSS scores, or CISA-KEV entries are associated with this item in the verified reference data.

4. Mitigation & containment

P1 — within 24 hours

• Audit Azure AD / Entra ID session and token hygiene. The ShinyHunters SaaS chain yielded 2,100+ token sets across 40+ tenants via a session-store dump. Revoke active refresh tokens and sessions for any identity that has authenticated to SaaS vendors holding tenant-wide or privileged access; review sign-in logs for anomalous token redemption patterns across tenants.
• Inventory SaaS vendors with privileged integration into your identity estate. Identify any provider that holds delegated permissions, service principals, or long-lived tokens in your tenant. Where the business relationship does not require tenant-wide access, revoke and re-scope.
• Block and review unauthorised AI proxy/reseller traffic. GTG-50021's scheme harvested Anthropic credentials via fraudulent resellers. Ensure egress to AI endpoints goes only via approved, contracted channels; treat unapproved AI proxy services as credential-harvesting infrastructure.

P2 — within 72 hours

• Hunt for the GTG-20006 pattern. The campaign targeted embassies, think tanks, defence-industrial firms, and government/defence/intelligence agencies across Europe and adjacent regions. If your organisation or clients fit this target set, review phishing lures, newly registered infrastructure, and C2 persistence mechanisms for the August 2025–September 2026 window, with emphasis on attacks that showed unusually rapid iteration between detection and modified payload — the AI-assisted rebuild-after-detection behaviour.
• Review WordPress exposure. GTG-50029 exploited a previously undocumented WordPress re-installation race condition enabling rogue administrator creation without valid credentials. If WordPress is in your estate or your third parties', verify re-installation flows are not exposed to unauthenticated requests and audit for unexplained administrator accounts.
• Validate secrets hygiene in mobile/Android assets. GTG-50014's pipeline mass-scanned 1.8M APKs for hard-coded secrets using TruffleHog. If you ship Android apps (or your vendors do), run secret-scanning against build artefacts and rotate any embedded credentials.

P3 — within 7 days

• Assess AI-vendor API key handling. GTG-50020 stole model-provider API keys and targeted ~30 AI vendors in four days. Rotate and scope-limit AI API keys; ensure they are not committed to code or exposed in CI/CD.
• Update third-party risk assessments for AI providers. Incorporate the SaaS-pivot pattern (vendor compromise → downstream customer data theft) into due diligence and ongoing monitoring for SaaS and AI vendors, per DORA Art. 28 obligations.
• Brief detection teams on AI-accelerated tradecraft. The practical defensive implication is tempo: AI-assisted actors compress the time between initial access, detection evasion, and exfiltration. Alerting thresholds and response playbooks tuned to human-speed campaigns may be too slow.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The sources describe campaign behaviours and actor tradecraft but contain no atomic artefacts (hashes, strings, mutexes, file paths, registry keys, command-line flags, or C2 domains) usable for YARA or Sigma rule construction. The behavioural indicators in §5 should be operationalised as hunts rather than rules.

7. Sources

• The Hacker News — Claude Used to Automate Exploitation and Data Theft Across Multiple Victims — https://thehackernews.com/2026/09/claude-used-to-automate-exploitation.html — 2026-09-11
• The Register — Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research — https://www.theregister.com/ai-and-ml/2026/09/10/latest-anthropic-horror-story-chills-with-tales-of-kamikaze-drone-swarms-and-bioweapons-research/5295702 — 2026-09-10
• The Hacker News — Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection — https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html — 2026-09
• SecurityWeek — Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion — https://www.securityweek.com/anthropic-says-russian-hackers-used-claude-ai-to-automate-malware-evasion/ — 2026-09
• Dark Reading — Anthropic: AI Attacks Result of Security Gaps, Not Model Issues — https://www.darkreading.com/cyber-risk/anthropic-ai-issues-result-security-gaps — 2026-09
• The Hacker News — Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 — https://thehackernews.com/2026/09/anthropic-ai-models-breached-real.html — 2026-09

8. Adverse Trace position

This item is a strategic/trend disclosure, not a vulnerability or active-incident advisory: no CVEs, no KEV entries, and no atomic IOCs are in scope, so we assign no technical severity and clients should not treat this as a patch-or-contain event. The operational takeaway for EMEA financial services is twofold. First, the SaaS supply-chain pattern is directly relevant: a single vendor compromise cascaded to ~200 customer organisations and 2,100+ Azure AD token sets across 40+ tenants, and financial entities are plausible downstream targets of exactly this pattern — identity-tier exposure via SaaS integrations is the control point, and it engages DORA Art. 28 and NIS2 Art. 21(2)(d) obligations. Second, AI-assisted tradecraft compresses attack tempo: GTG-20006 automated development through exfiltration and iterated malware past detections, which means detection-to-response timelines tuned to human-speed adversaries are now a structural weakness. Attribution confidence is limited: all GTG designations, target counts, and actor mappings (including GTG-20006 to Midnight Blizzard/APT29) are single-sourced to Anthropic's report and "Generative Threat Groups" has no MITRE ATT&CK profile — treat as unconfirmed pending independent corroboration, and do not use these designations for enforcement actions. We will monitor for the underlying Anthropic report, independent corroboration of the GTG clusters, and any IOCs emerging from follow-on vendor or CERT reporting; clients with SaaS vendors holding privileged tenant access should treat the P1 actions above as immediately actionable regardless of attribution confidence.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.