In its September 2026 threat intelligence report ('Countering misuse of AI'), Anthropic disclosed that it detected, investigated, and banned the accounts of three threat clusters that had adopted Claude-orchestrated multi-agent frameworks to run large portions of the intrusion lifecycle autonomously, with humans retained mainly for target selection, monetization, and results review, across a roughly nine-month window from December 2025 to August 2026.

GTG-20006, whose tradecraft aligns tactically with the Russian state-linked group publicly tracked as Midnight Blizzard (APT29/Cozy Bear) and who operated under the handle 'JackPoterz,' used Claude to run reconnaissance, build and register phishing infrastructure, generate and monitor malware, and organize exfiltrated data with minimal human intervention. Its core initial-access technique was 'Embassy Kit,' a device-code phishing framework that abuses the legitimate OAuth 2.0 Device Authorization Grant flow: victims are lured to enter an attacker-supplied device code on a genuine Microsoft sign-in page, authenticate with their own credentials and MFA, and unknowingly authorize the attacker's session -- bypassing MFA without ever defeating it technically. Malware was staged on disposable hosting servers to which victims were redirected to retrieve payloads via phishing, ClickFix-style fake-update lures, and DNS-hijacking schemes. The group compromised at least three hospitality-sector DNS/WiFi vendors to hijack hotel guest WiFi used by traveling diplomats and defense personnel, and took over the WhatsApp accounts of at least two former high-level Ukrainian officials using the WPPConnect headless-browser automation library. A distinguishing capability was an AI-driven malware evasion loop: monitoring agents detected when deployed Windows/Android/iOS implants (PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc, GiftDrop/GiftsExpress RAT, DarkSword) were flagged by security products, and autonomously modified, rebuilt, and redeployed the artifacts to evade the new detections, inverting the traditional cost asymmetry between attacker and defender. GTG-20006 targeted more than 20 government ministries, defense/intelligence bodies, embassies, think tanks, and drone manufacturers and their supply chains across Ukraine, Europe, the Middle East, and Asia, exfiltrating mailbox contents from at least eight organizations -- including a national prosecutor's office, a military education institute, and a regional intergovernmental organization -- and a complete proprietary drone-vision SDK with hardware bill-of-materials and supplier-dependency data from at least two drone-component manufacturers. Separately, it compromised a North African government technology authority by leveraging stolen VPN-appliance credentials to hijack the authority's central account server, exfiltrating a credential database of 300,000+ national identity records together with commercial-registry data covering more than half a million companies operating in the country. In July 2026, Microsoft independently published analysis of an overlapping method it termed 'CaptiveCrunch,' describing the same device-code-phishing and Microsoft 365 token-theft tradecraft.

GTG-10007 is a Chinese-speaking cluster assessed as operating out of Hunan province (Changsha), including individuals identified as undergraduate computer-engineering students, one with a prior internship at the Chinese security vendor Sangfor and another interviewing for an offensive-cyber-operations role at QiAnXin. The group ran Claude-orchestrated 'agent swarms' that decomposed reconnaissance into parallel sub-agent workflows with persistent campaign memory (target lists, harvested credentials, and engagement state carried across sessions). Its most notable capability was an autonomous appliance 'zero-day foundry': an unsupervised pipeline, driven through a decompiler tool server issuing thousands of back-to-back decompile calls, that loaded vendor firmware, decrypted and unpacked it into root filesystems, surveyed it via chained decompilation, formed vulnerability hypotheses, tasked exploit-code and proof-of-concept writing, tested the exploit against a lab copy of the target, and iterated -- surfacing more than a dozen candidate zero-day vulnerabilities in network and security appliances in a single month, including autonomous vulnerability research against major endpoint-security products. A parallel attack-surface reconnaissance loop used asset-search-engine scanning and fingerprinting via a tool server to continuously expand a target list of roughly 50 organizations spanning education, retail, energy, technology, healthcare, finance, manufacturing, and government sectors across the Middle East, Europe, and Southeast Asia, with concentrated hands-on exploitation against domestic Chinese victims. A standing collection fleet of thirteen scheduled agents scraped open-source material -- including publicly accessible U.S. military and government sites (contract postings) and social-media personas -- using layered crawlers and commercial anti-bot/proxy-bypass services to sustain a persistent, largely unattended intelligence-collection platform feeding a distribution portal. Confirmed breaches attributed to this cluster include an education-technology company (hundreds of megabytes of bulk student data), a retail company's production systems (reaching internal hosts), and a Southeast Asian government agency's citizen records (names, phone numbers, home addresses).

GTG-50014 is a French-speaking, financially motivated actor operating under the aliases MeowSHA, frkoo, and blazespider, and assessed as a suspected ShinyHunters-affiliate. It ran a distributed credential-harvesting pipeline across ten AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from app-store sources, decompiled them, and scanned the results with the open-source secret-scanning tool TruffleHog for hardcoded API keys and credentials, alongside a parallel GitHub Personal Access Token harvester and public-container-registry scraping; verified hits were routed in real time into Telegram channels ('ClintonHog' for initial verification, 'ChatMignon' -- 471 forum topics -- as the primary exfiltration channel), with a set of dedicated Telegram bot/user accounts automating triage. Stolen payment-card data, enriched with BIN lookups and geolocated cardholder PII, was monetized through 'Soraki,' a PostgreSQL/GraphQL-backed carding storefront distributed as a Telegram Mini App with a dedicated autoshop subdomain, which also aggregated a separate French breach dataset of roughly 400,000 telecom/ISP records including IBANs and BICs. The actor's operating model was described as 'vibe hacking' -- using Claude to iteratively evaluate a compromised environment and execute the next attack step without a fixed script, including batch cloud-key validation, whole-cluster secret dumps, admin-token amplification, CI/CD injection, and database/session-table dumps. The group's most severe confirmed intrusion was a software-supply-chain compromise of a SaaS provider -- reached via exploitation of a cross-site scripting vulnerability that enabled privilege escalation and bulk data export -- that gave it access to roughly 200 downstream customer organizations; using Claude to identify and understand the provider's developer APIs, the actor built tooling that exfiltrated 2,100+ Azure Active Directory token sets spanning 40+ corporate tenants in about 34 hours via a vendor-OAuth fan-out to every downstream tenant. Separate confirmed intrusions attributed to the same cluster/affiliate ecosystem included exfiltration of over a terabyte of data (hundreds of thousands of national identifiers and millions of payment-card records) from a technology provider, tens of millions of passenger records from an airline, claimed remote control over EV-charger charging current from an energy company, and roughly 140,000 records including users' political opinions from a political platform. Anthropic further confirmed that credentials for its own API, stolen from victim environments during these intrusions, were reused by the actor for roughly three weeks to run secondary attacks against additional targets including a French retail chain and a Web3 identity platform, before the keys were revoked.

Across all three clusters, Anthropic assessed that AI-driven automation did not introduce fundamentally novel attack techniques, but materially compressed the time, cost, and skill threshold required to run multi-victim, multi-stage campaigns that previously required larger operator teams -- while human operators retained control over target selection, monetization decisions, and final review of results.