# Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft

> Anthropic disrupted three distinct clusters weaponizing Claude's multi-agent framework for autonomous offensive operations: GTG-20006 (Russian state-linked, tactically overlapping with Midnight Blizzard) ran AI-orchestrated device-code phishing, self-repairing malware, and data theft against Ukrainian/European government and drone-supply-chain targets, and breached a North African government authority for 300,000+ national identity records plus commercial-registry data on 500,000+ companies. GTG-10007 (Hunan-based, Chinese-speaking) ran an autonomous firmware-decompilation 'zero-day foundry' yielding a dozen-plus candidate vulnerabilities per month and standing collection agents scraping government/military sites. A suspected ShinyHunters affiliate (GTG-50014) used a 10-node AWS EC2 fleet to decompile 1.8 million Android APKs for hardcoded secrets and breached a SaaS provider via a cross-site scripting flaw that enabled privilege escalation, stealing 2,100+ Azure AD token sets across 40+ tenants in roughly 34 hours, later reusing stolen Anthropic API keys for follow-on attacks.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2466
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-claude-ai-device-code-phishing-tl-2026-2466.webp?v=6c0a5acc (Threadlinqs threat intel: GTG-20006 Claude AI Cyberattacks: Analysis & Hunting (TL-2026-2466) — Critical severity, 30 IOCs, 9 detection rules.)
- **ID:** TL-2026-2466
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** GTG-20006 (Russia, China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

In its September 2026 threat intelligence report ('Countering misuse of AI'), Anthropic disclosed that it detected, investigated, and banned the accounts of three threat clusters that had adopted Claude-orchestrated multi-agent frameworks to run large portions of the intrusion lifecycle autonomously, with humans retained mainly for target selection, monetization, and results review, across a roughly nine-month window from December 2025 to August 2026.

GTG-20006, whose tradecraft aligns tactically with the Russian state-linked group publicly tracked as Midnight Blizzard (APT29/Cozy Bear) and who operated under the handle 'JackPoterz,' used Claude to run reconnaissance, build and register phishing infrastructure, generate and monitor malware, and organize exfiltrated data with minimal human intervention. Its core initial-access technique was 'Embassy Kit,' a device-code phishing framework that abuses the legitimate OAuth 2.0 Device Authorization Grant flow: victims are lured to enter an attacker-supplied device code on a genuine Microsoft sign-in page, authenticate with their own credentials and MFA, and unknowingly authorize the attacker's session -- bypassing MFA without ever defeating it technically. Malware was staged on disposable hosting servers to which victims were redirected to retrieve payloads via phishing, ClickFix-style fake-update lures, and DNS-hijacking schemes. The group compromised at least three hospitality-sector DNS/WiFi vendors to hijack hotel guest WiFi used by traveling diplomats and defense personnel, and took over the WhatsApp accounts of at least two former high-level Ukrainian officials using the WPPConnect headless-browser automation library. A distinguishing capability was an AI-driven malware evasion loop: monitoring agents detected when deployed Windows/Android/iOS implants (PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc, GiftDrop/GiftsExpress RAT, DarkSword) were flagged by security products, and autonomously modified, rebuilt, and redeployed the artifacts to evade the new detections, inverting the traditional cost asymmetry between attacker and defender. GTG-20006 targeted more than 20 government ministries, defense/intelligence bodies, embassies, think tanks, and drone manufacturers and their supply chains across Ukraine, Europe, the Middle East, and Asia, exfiltrating mailbox contents from at least eight organizations -- including a national prosecutor's office, a military education institute, and a regional intergovernmental organization -- and a complete proprietary drone-vision SDK with hardware bill-of-materials and supplier-dependency data from at least two drone-component manufacturers. Separately, it compromised a North African government technology authority by leveraging stolen VPN-appliance credentials to hijack the authority's central account server, exfiltrating a credential database of 300,000+ national identity records together with commercial-registry data covering more than half a million companies operating in the country. In July 2026, Microsoft independently published analysis of an overlapping method it termed 'CaptiveCrunch,' describing the same device-code-phishing and Microsoft 365 token-theft tradecraft.

GTG-10007 is a Chinese-speaking cluster assessed as operating out of Hunan province (Changsha), including individuals identified as undergraduate computer-engineering students, one with a prior internship at the Chinese security vendor Sangfor and another interviewing for an offensive-cyber-operations role at QiAnXin. The group ran Claude-orchestrated 'agent swarms' that decomposed reconnaissance into parallel sub-agent workflows with persistent campaign memory (target lists, harvested credentials, and engagement state carried across sessions). Its most notable capability was an autonomous appliance 'zero-day foundry': an unsupervised pipeline, driven through a decompiler tool server issuing thousands of back-to-back decompile calls, that loaded vendor firmware, decrypted and unpacked it into root filesystems, surveyed it via chained decompilation, formed vulnerability hypotheses, tasked exploit-code and proof-of-concept writing, tested the exploit against a lab copy of the target, and iterated -- surfacing more than a dozen candidate zero-day vulnerabilities in network and security appliances in a single month, including autonomous vulnerability research against major endpoint-security products. A parallel attack-surface reconnaissance loop used asset-search-engine scanning and fingerprinting via a tool server to continuously expand a target list of roughly 50 organizations spanning education, retail, energy, technology, healthcare, finance, manufacturing, and government sectors across the Middle East, Europe, and Southeast Asia, with concentrated hands-on exploitation against domestic Chinese victims. A standing collection fleet of thirteen scheduled agents scraped open-source material -- including publicly accessible U.S. military and government sites (contract postings) and social-media personas -- using layered crawlers and commercial anti-bot/proxy-bypass services to sustain a persistent, largely unattended intelligence-collection platform feeding a distribution portal. Confirmed breaches attributed to this cluster include an education-technology company (hundreds of megabytes of bulk student data), a retail company's production systems (reaching internal hosts), and a Southeast Asian government agency's citizen records (names, phone numbers, home addresses).

GTG-50014 is a French-speaking, financially motivated actor operating under the aliases MeowSHA, frkoo, and blazespider, and assessed as a suspected ShinyHunters-affiliate. It ran a distributed credential-harvesting pipeline across ten AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs from app-store sources, decompiled them, and scanned the results with the open-source secret-scanning tool TruffleHog for hardcoded API keys and credentials, alongside a parallel GitHub Personal Access Token harvester and public-container-registry scraping; verified hits were routed in real time into Telegram channels ('ClintonHog' for initial verification, 'ChatMignon' -- 471 forum topics -- as the primary exfiltration channel), with a set of dedicated Telegram bot/user accounts automating triage. Stolen payment-card data, enriched with BIN lookups and geolocated cardholder PII, was monetized through 'Soraki,' a PostgreSQL/GraphQL-backed carding storefront distributed as a Telegram Mini App with a dedicated autoshop subdomain, which also aggregated a separate French breach dataset of roughly 400,000 telecom/ISP records including IBANs and BICs. The actor's operating model was described as 'vibe hacking' -- using Claude to iteratively evaluate a compromised environment and execute the next attack step without a fixed script, including batch cloud-key validation, whole-cluster secret dumps, admin-token amplification, CI/CD injection, and database/session-table dumps. The group's most severe confirmed intrusion was a software-supply-chain compromise of a SaaS provider -- reached via exploitation of a cross-site scripting vulnerability that enabled privilege escalation and bulk data export -- that gave it access to roughly 200 downstream customer organizations; using Claude to identify and understand the provider's developer APIs, the actor built tooling that exfiltrated 2,100+ Azure Active Directory token sets spanning 40+ corporate tenants in about 34 hours via a vendor-OAuth fan-out to every downstream tenant. Separate confirmed intrusions attributed to the same cluster/affiliate ecosystem included exfiltration of over a terabyte of data (hundreds of thousands of national identifiers and millions of payment-card records) from a technology provider, tens of millions of passenger records from an airline, claimed remote control over EV-charger charging current from an energy company, and roughly 140,000 records including users' political opinions from a political platform. Anthropic further confirmed that credentials for its own API, stolen from victim environments during these intrusions, were reused by the actor for roughly three weeks to run secondary attacks against additional targets including a French retail chain and a Web3 identity platform, before the keys were revoked.

Across all three clusters, Anthropic assessed that AI-driven automation did not introduce fundamentally novel attack techniques, but materially compressed the time, cost, and skill threshold required to run multi-victim, multi-stage campaigns that previously required larger operator teams -- while human operators retained control over target selection, monetization decisions, and final review of results.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1583.001 Domains
- T1587.004 Exploits
- T1584.002 DNS Server
- T1566 Phishing
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1204 User Execution
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1114 Email Collection
- T1027 Obfuscated Files or Information
- T1078.004 Cloud Accounts
- T1567 Exfiltration Over Web Service
- T1567.002 Exfiltration to Cloud Storage

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GTG-50014 Mass Azure AD Token Exfiltration via Vendor-OAuth Fan-Out to Telegram** (`TL-2026-2466-SPL-003`)

Detects the SaaS-supply-chain token-theft pattern used by GTG-50014, where a compromised SaaS provider's vendor-OAuth trust relationship is abused to harvest large volumes of Azure AD/Entra token sets across many downstream tenants in a short window (2,100+ tokens across 40+ tenants in roughly 34 hours), followed by outbound traffic to the Telegram Bot API infrastructure feeding the ChatMignon/ClintonHog exfiltration channels.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1528, T1199, T1567, T1567.002
- **Data sources:** azure_ad_audit_logs, oauth_consent_logs, proxy_web_logs, firewall_netflow
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=azuread sourcetype="azure:aad:audit" (OperationName="Consent to application" OR OperationName="Add app role assignment to service principal")
| stats dc(TargetResources.tenantId) as distinct_tenants dc(TargetResources.id) as distinct_tokens min(_time) as first_seen max(_time) as last_seen by InitiatedBy.app.appId
| where distinct_tenants >= 5 AND (last_seen-first_seen) <= 172800
| join type=left "InitiatedBy.app.appId"
    [ search index=proxy dest_host="api.telegram.org"
      | stats count as telegram_posts by src_ip
      | rename src_ip as "InitiatedBy.app.appId" ]
| table InitiatedBy.app.appId, distinct_tenants, distinct_tokens, first_seen, last_seen, telegram_posts
| where distinct_tenants >= 5
```

### Microsoft KQL

```kql
AuditLogs
| where TimeGenerated > ago(48h)
| where OperationName in ("Consent to application","Add service principal","Add app role assignment to service principal")
| summarize DistinctTenants = dcount(tostring(TargetResources[0].tenantId)), TokenEvents = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by AppId = tostring(InitiatedBy.app.appId)
| where DistinctTenants >= 5 and datetime_diff('hour', LastSeen, FirstSeen) <= 48
| join kind=leftouter (
    CommonSecurityLog
    | where DestinationHostName == "api.telegram.org"
    | summarize TelegramPosts = count() by SourceIP
) on $left.AppId == $right.SourceIP
| project AppId, DistinctTenants, TokenEvents, FirstSeen, LastSeen, TelegramPosts
```

### Sigma

```yaml
title: GTG-50014 Mass Azure AD Token Exfiltration via Vendor-OAuth Fan-Out
id: 5e2d1c0b-8a7f-4b6e-9c3d-2f1e0d9c8b7a
status: experimental
description: Detects a single vendor app registration issuing/consenting tokens across an anomalously high number of distinct downstream tenants in a short window, consistent with GTG-50014's SaaS supply-chain token-theft operation.
references:
    - https://www.anthropic.com/threat-intelligence-report-september-2026
author: Threadlinqs Team
date: 2026-09-12
tags:
    - attack.credential-access
    - attack.t1528
    - attack.initial-access
    - attack.t1199
    - attack.exfiltration
    - attack.t1567
    - attack.t1567.002
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        OperationName:
            - 'Consent to application'
            - 'Add service principal'
            - 'Add app role assignment to service principal'
    timeframe: 48h
    condition: selection | count(TargetResources.tenantId) by InitiatedBy.app.appId > 5
falsepositives:
    - Legitimate high-volume token issuance during an authorized bulk tenant onboarding/migration event by a trusted vendor
level: critical
```

**Known false positives:**

- Legitimate high-volume token issuance during an authorized bulk tenant onboarding/migration event by a trusted vendor

**Tuning notes:** Alert on token-issuance velocity per single vendor app registration crossing a tenant-specific baseline (e.g., >5 distinct tenants within 48h); correlate with outbound traffic to api.telegram.org from the same egress path as the token-issuing service.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SaaS Provider XSS-to-Privilege-Escalation Exploitation Enabling Bulk Data Export (locked: unlock with TL Creds)
- GTG-10007 Agent-Swarm Reconnaissance — High-Tempo Parallel Asset Enumeration (locked: unlock with TL Creds)
- WPPConnect Headless-Browser WhatsApp Takeover + Hospitality DNS-Hijack Malware Redirect (locked: unlock with TL Creds)
- Embassy Kit OAuth Device Code Phishing Sign-In (Sigma) (locked: unlock with TL Creds)
- CloudSyncSvc/MiniPlasma/WUEngine/PowerChrome Masquerading Persistence (Sigma) (locked: unlock with TL Creds)
- Beacon to Known GTG-20006/GTG-50014 C2 and Carding Infrastructure (Sigma) (locked: unlock with TL Creds)
- Embassy Kit Device-Code Phishing — Anomalous OAuth Device Authorization Grant Sign-In (locked: unlock with TL Creds)
- GTG-20006 Implant Rebuild/Re-Obfuscation Cadence — PowerChrome/WUEngine/Shadow C2/MiniPlasma/CloudSyncSvc (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `104.145.210[.]184`
- Domain: `ms365-live[.]com`
- File hash: `be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data](https://gbhackers.com/threat-actors-use-claude-ai-agents-to-automate-cyberattacks-and-steal-sensitive-data/)
- [Countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)
- [Claude Used to Automate Exploitation and Data Theft Across Multiple Victims](https://thehackernews.com/2026/09/claude-used-to-automate-exploitation.html)
- [Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection](https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html)
- [Hackers Use Claude AI Agents to Automate Cyberattacks, Develop Zero-Days and Evade Detection](https://cybersecuritynews.com/claude-ai-agents-used-to-automate-cyberattacks/)
- [Midnight Blizzard-Linked Actor GTG-20006 Automated Device Code Phishing With AI](https://www.aegisai.ai/blog/anthropic-midnight-blizzard-ai-device-code-phishing)
- [Anthropic Details Disrupted Claude Misuse Across Seven Harm Areas](https://www.unite.ai/anthropic-details-disrupted-claude-misuse-across-seven-harm-areas/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2466