Anthropic says Claude was abused to scan 1.8 million Android apps for secrets
Image: Primary Anthropic says a French-speaking actor using the handle 'frkoo' and linked to the ShinyHunters collective ran a credential-harvesting pipeline across ten AWS EC2 workers that mass-downloaded 1.8 million distinct Android APKs, decompiled them and scanned for hardcoded secrets with TruffleHog, routing verified findings to a Telegram group.
Anthropic says the same actor collected GitHub organization email addresses to obtain personal access tokens, and that a suspected ShinyHunters member extracted more than 2,100 Azure AD authentication tokens across over 40 corporate Microsoft tenants in about 34 hours, with AI agents performing nearly all the work.
Anthropic says it disrupted the activity and banned the accounts.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
