GoKawiilAnthropic reports ShinyHunters used Claude AI to mine 1.8M Android apps for secrets
Anthropic disclosed that between December 2025 and August 2026 it detected and disrupted misuse of its Claude AI models by multiple threat actors, including groups tied to ShinyHunters. One French-speaking member, 'frkoo', ran automated pipelines on AWS servers that downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded credentials using TruffleHog, funneling verified findings into a categorized Telegram network. The same actor also harvested GitHub organization emails to obtain access tokens and ran a carding site impersonating French police to sell stolen payment data.
GoKawiil's interpretation of the reporting above, not reported fact.
The case shows how AI coding assistants can be weaponized to automate large-scale credential theft that would otherwise require significant manual effort, lowering the barrier for sophisticated cybercrime operations. It also highlights the exposure risk from developers embedding secrets directly in mobile app code, since a single automated pipeline compromised data at massive scale. Anthropic's disclosure signals growing pressure on AI vendors to detect and shut down abuse of their models in near real time.
- A hacker used AWS infrastructure and Claude to scan 1.8 million Android APKs for hardcoded secrets.
- Stolen credentials and GitHub tokens were used to breach organizations, including a SaaS provider affecting 200 downstream clients.
- The same actor ran a carding shop impersonating French police to sell stolen payment card data.
Yubico YubiKey 5 NFC Security Key — Since attacks like ShinyHunters' typically start with stolen credentials and social engineering, a hardware security key is one of the strongest defenses you can add to your accounts. The YubiKey 5 NFC plugs into USB-A or taps against a phone via NFC, and works with major services that support FIDO2/WebAuthn logins. It's a simple physical step that keeps a phished password from being enough.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-11
Published there as: “Hackers abused Claude to extract secrets from 1.8M Android apps”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.