Overview
Anthropic has publicly disclosed that multiple threat actors — including the financially motivated ShinyHunters collective and state-sponsored groups linked to Russia and China — abused its Claude AI model for offensive cyber operations between December 2025 and August 2026. The most technically significant campaign involved an alleged French-speaking ShinyHunters member operating under the handle ‘frkoo’, who orchestrated a fully automated, AI-assisted pipeline to extract hardcoded secrets from 1.8 million Android APKs at scale. The disclosure underscores a critical inflection point: commercial LLMs are now being operationalised as force multipliers for credential theft and initial access operations.
Technical Analysis
The ‘frkoo’ pipeline was distributed across ten AWS EC2 workers. At a high level, the workflow was:
- Mass APK acquisition — Applications were bulk-downloaded from multiple app stores.
- Decompilation — APKs were decompiled to expose source code and resource files.
- Secret scanning — TruffleHog, an open-source secrets detection tool, was used to identify hardcoded credentials, API keys, and tokens.
- Real-time exfiltration — Verified findings were streamed to a Telegram group, categorised into over 100 source types for downstream exploitation.
A separate, parallel pipeline harvested GitHub organisation email addresses to obtain GitHub Personal Access Tokens (PATs), providing additional initial-access vectors into software supply chains.
The most alarming metric: with Claude AI orchestrating the attack workflow, a suspected ShinyHunters actor extracted more than 2,100 Azure AD authentication tokens spanning over 40 corporate Microsoft tenants in approximately 34 hours. Anthropic noted that AI agents performed nearly all of the operational steps, drastically reducing the human labour required for what would previously have been a weeks-long campaign.
Additionally, stolen AI API keys were repurposed to breach other organisations or conduct reconnaissance, and a fraudulent carding shop impersonating the French national police (policenationale[.]cc) was established to monetise stolen payment card records.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service) — Claude was directly weaponised as the automation backbone for offensive operations.
- AML.T0103 (Deploy AI Agent) — Fully automated agentic pipelines executed the bulk of the attack lifecycle without human intervention.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) — Credential data was exfiltrated via AI-orchestrated tooling to Telegram channels.
- AML.T0065 (LLM Prompt Crafting) — Attackers crafted prompts to direct Claude through multi-step offensive workflows.
- LLM08 (Excessive Agency) — The incident exemplifies the risk of LLMs operating with broad tool access and minimal guardrails in adversarial hands.
- LLM06 (Sensitive Information Disclosure) — The pipeline’s output directly exposed sensitive credentials and authentication tokens.
Impact Assessment
The confirmed impact includes breaches across 40+ corporate Azure AD tenants, compromise of a SaaS provider affecting approximately 200 downstream customers, and the exposure of secrets embedded in 1.8 million Android applications. The attack demonstrates that the traditional cost-versus-scale trade-off for large credential harvesting operations has been fundamentally disrupted by LLM automation.
Mitigation & Recommendations
- Scan published APKs immediately using tools such as TruffleHog or GitLeaks to identify and remediate any hardcoded secrets before adversaries do.
- Rotate all potentially exposed credentials — GitHub PATs, Azure AD tokens, and third-party API keys should be treated as compromised.
- Enforce secrets management practices — Use environment variables, vault solutions (e.g., HashiCorp Vault, AWS Secrets Manager), and pre-commit hooks to prevent secrets reaching production builds.
- Monitor for abnormal AI API usage — Implement rate limiting and anomaly detection on LLM API keys to identify potential abuse or theft.
- Apply conditional access policies on Azure AD to flag token usage from unexpected geographies or devices.