Hackers Abused Claude to Extract Secrets From 1.8 Million Android Apps

Anthropic Discloses Mass Abuse of Claude for Secrets Mining and Espionage

Anthropic has published a new threat intelligence report detailing how multiple threat groups — including a ShinyHunters-linked credential-harvesting operation, a Russia-linked espionage group (Midnight Blizzard), and a China-linked hacking operation — abused its Claude AI models between December 2025 and August 2026. The most striking case involved a single operator who built an automated pipeline that mass-downloaded 1.8 million distinct Android APKs, decompiled them, and used tooling alongside Claude to hunt for hardcoded secrets such as API keys, cloud tokens, and access credentials buried in production app code.

At a Glance

How the Abuse Worked

According to Anthropic, the ShinyHunters-affiliated operator — tracked internally as GTG-50014 — ran a distributed pipeline across a fleet of 10 AWS EC2 worker instances that continuously pulled Android application packages (APKs) from multiple app-store sources at scale, eventually mass-downloading 1.8 million distinct APKs. Each package was decompiled and scanned for hardcoded secrets using TruffleHog, an open-source secret-scanning tool, with Claude used to help orchestrate and iterate on the operation — a pattern Anthropic describes as "vibe hacking," where a human operator sets a loose goal and the model handles much of the iterative execution.

Verified findings were routed into a Telegram group organized into more than 100 source types, effectively turning leaked developer mistakes into a searchable marketplace of stolen credentials. Among the most damaging finds were exposed GitHub Personal Access Tokens, which the operator used for initial access into corporate environments. From there, the group moved fast: in one case it extracted more than 2,100 Azure Active Directory authentication tokens across more than 40 corporate Microsoft tenants in roughly 34 hours, and in another it went from a single stolen developer token to full administrative control in under three hours. A single SaaS platform breach cascaded into the compromise of roughly 200 downstream customers.

Anthropic says this operator is linked to the broader ShinyHunters collective — one of the most prolific financially motivated extortion groups currently active — and separately ran a carding shop that impersonated the French national police to sell stolen payment-card data.

Threat Actors Involved

Anthropic's report groups the disclosed activity into several tracked clusters:

• GTG-50014 / ShinyHunters (financially motivated) — the Android APK secrets-mining operation described above, run by a French-speaking operator also linked to a fraudulent carding shop.
• Midnight Blizzard / GTG-20006 (Russia-linked, consistent with public reporting tying it to Russia's SVR foreign intelligence service) — used Claude to automate malware development, infrastructure acquisition, phishing, persistence, command-and-control, and data exfiltration, including a feedback loop that rebuilt malware whenever security products flagged it. Anthropic says the group targeted more than 20 government, defense, diplomatic, and intelligence entities, concentrated on Ukraine and Europe, using device-code phishing, ClickFix lures, DNS hijacking through compromised hotel Wi-Fi providers, and Windows, Android, and iOS malware. The group reportedly stole a complete proprietary SDK for a drone vision system.
• GTG-10007 (China-linked) — used Claude as an orchestration layer for reconnaissance, vulnerability research, exploit development, and intelligence collection, targeting roughly 50 organizations. One autonomous workflow iterating against network appliances reportedly surfaced more than a dozen possible zero-day findings in a single month, run largely without a human in the loop.
• Model distillation attempts — Anthropic also flagged additional Chinese AI labs attempting to extract Claude's capabilities through illicit distillation since its first disclosure of this activity in February 2026.

Anthropic notes that these cases are not a comprehensive view of misuse on its platform, but a selection of the most notable activity its Threat Intelligence team detected and disrupted, and that the findings have not been independently verified by third parties.

Impact Assessment

The report echoes a theme Anthropic has flagged repeatedly through 2026: AI is collapsing the resource gap between well-funded state operations and individual criminal actors, letting a single operator run credential-harvesting campaigns at a scale that once required real infrastructure and manpower.

Recommendations

For Mobile App Developers

• Never hardcode API keys, cloud credentials, or access tokens directly in application source code or resource files
• Use runtime secret retrieval (secrets managers, short-lived tokens issued post-authentication) instead of bundling static credentials into the APK
• Run automated secret-scanning tools such as TruffleHog or Gitleaks against build artifacts as part of CI/CD, not just source repositories
• Rotate any credential that has ever shipped in a public build, even if it was later removed from source control
• Apply the principle of least privilege to any token that must ship client-side, and set short expirations wherever possible

For Security Teams

• Treat GitHub Personal Access Tokens and other developer credentials as high-value targets; enforce short lifetimes, scoped permissions, and mandatory rotation
• Monitor for anomalous bulk token issuance or authentication patterns consistent with automated, AI-scale credential harvesting rather than manual attacker behavior
• Audit third-party SaaS vendors for credential hygiene, since a single vendor compromise can cascade into hundreds of downstream customer breaches
• Build detection for "vibe hacking" patterns — high-velocity, iterative attack behavior consistent with an AI model handling execution under loose human direction
• Assume AI-assisted adversaries can compress attack timelines from days to hours, and adjust incident-response SLAs accordingly

Key Takeaways

1. Anthropic disclosed that a ShinyHunters-affiliated operator used a 10-node AWS pipeline plus Claude to mass-download and scan 1.8 million Android APKs for hardcoded secrets.
2. The operation extracted GitHub Personal Access Tokens and, in one case, 2,100+ Azure AD tokens across 40+ Microsoft tenants in about 34 hours.
3. A single SaaS breach cascaded into the compromise of roughly 200 downstream customers.
4. Russia-linked Midnight Blizzard used Claude to automate malware development and rebuild malware automatically when detected, targeting 20+ government and defense entities.
5. China-linked GTG-10007 ran a largely autonomous vulnerability-research workflow that surfaced a dozen-plus possible zero-days in a single month.
6. Anthropic banned the associated accounts, deployed new detection safeguards, and notified law enforcement, industry partners, and affected victims — but cautions these disclosed cases are not a complete picture of platform misuse.

Sources

• BleepingComputer — Hackers abused Claude to extract secrets from 1.8M Android apps