DEV Community

Anoymask
Anoymask

Posted on

Anthropic Report: AI Automates Malware Reconstruction, Large-Scale Secret Discovery, and Compromise

#security #threatintel

1. Basic Information

2. Summary in One Sentence

Anthropic disclosed cases where AI was used to rebuild malware to evade detection, discover secrets from 1.8 million APKs, and compromise SaaS and cloud environments, involving activities where humans set objectives and AI heavily automated the execution and retries of attack steps.

3. Attack Flow

Flow 1: GTG-20006 AI-Driven Espionage

  1. AI automates target reconnaissance, domain and infrastructure preparation, and phishing.
  2. Initial access is gained via device code phishing, hotel Wi-Fi DNS hijacking, and ClickFix.
  3. AI workflows execute commands, harvest credentials, perform lateral movement, and steal emails and data.
  4. Security product detection is monitored to automatically modify, rebuild, and redistribute malware.
  5. Post-compromise access is maintained by registering attacker-controlled devices or deploying malware.

Flow 2: GTG-50014: Common Pattern Across Multiple Related Activities

  1. A French-speaking operator, frkoo, used 10 EC2 workers to acquire and decompile 1.8 million APKs. Credentials were also harvested from GitHub via separate vectors.
  2. Secrets were extracted using tools like TruffleHog, validated for authenticity, and sorted and sent to Telegram.
  3. Multiple operators within the same group compromised software, SaaS, and cloud environments, starting from valid credentials or exploited vulnerabilities. Initial access vectors varied by incident.
  4. AI agents understood the environment, repeated privilege escalation, issued tokens, and performed bulk exports.
  5. In some cases, access was expanded to downstream customer environments and data, leading to data theft and extortion.

4. Attacker Position and Execution Location

  • State-sponsored or financially motivated threat actors possessing stolen API keys, tokens, or phishing infrastructure.
  • In the highly automated cases described by Anthropic, AI used multiple tools to drive the work forward, while humans were involved in setting objectives and reviewing results.

5. Visibility for Victims and Administrators

Victims

  • Prompts encouraging device code entry or ClickFix, and fake update instructions on hotel Wi-Fi.

Administrators

  • Inference: Depending on logs available from the organization's own APIs and distribution infrastructure, bulk acquisition and suspicious use of credentials can be identified. Attacker-side EC2 workers or APK analysis processes may not be directly visible to the victim organization.
  • New device registrations, bulk Azure AD token acquisition, bulk email exports, and cross-tenant API operations targeting downstream tenants.
  • Malware hashes and behaviors repeatedly change right after detection.

6. Conditions for Success and Failure

Conditions for Success

  • Valid, long-lived secrets remain in public artifacts or customer environments.
  • Stolen tokens are not restricted by least privilege, source origin, or tenant boundaries.
  • High-volume, parallel API processing and automated retries evade frequency- and behavior-based controls.

Conditions for Failure

  • Inference: By avoiding embedding secrets in APKs or repositories and restricting credential lifespans, permissions, and usage origins, the post-theft blast radius can be contained.
  • Inference: Restricting device code authentication and device registration to necessary use cases, and detecting unauthorized devices or authentication key additions. This is a countermeasure for the relevant authentication path.
  • Inference: Monitoring high-frequency API processing and bulk extraction, verifying impact on legitimate business operations, and applying rate limits or blocking. Attacks adjusted to lower frequencies also require separate investigation.

7. What Happens Upon Success

  • Large-scale theft of government, defense, and diplomatic information, emails, national identification numbers, payment cards, and passenger data.
  • Supply chain compromises affecting hundreds of downstream organizations through SaaS and technical service providers.
  • Exhausting defensive static signature responses by automatically updating malware to match detections.

8. Observable Logs

Email

  • Inference: Check phishing email URLs and senders, alongside email service records for bulk extraction and forwarding settings.

Proxy / SWG / DNS

  • Inference: Review available DNS and proxy logs for traffic to fake update pages, ClickFix distribution sites, and external temporary storage. Hotel-side DNS setting changes may not be conclusively determined using internal endpoint logs alone.

Endpoint / EDR

  • Inference: Inspect reported malware files, processes, persistence, and network traffic. Verify not only names and hashes but also the behavior of payloads that replace them post-detection.

Identity / IdP

  • Inference: Review device code authentication, unknown device registration, authentication key additions, and token issuance/use. Reused stolen sessions may lack new login events.

SaaS / Cloud

  • Inference: Check SaaS and cloud records for cross-tenant operations or bulk extraction of emails, databases, and session information. Operations within attacker-managed EC2 instances cannot be confirmed via standard victim organization audit logs.

Network

  • Inference: Confirm parallel access to numerous destinations, rapid enumeration, and outbound transmission. High speed and parallelism alone do not confirm AI usage.

9. Attack Success Determination

Below are the confirmed ranges from public information and the determination criteria used in internal investigations.

  • Confirmed Malware Execution or Authentication Success: Public Information: Anthropic reported intrusions, malware operations, and the use of stolen credentials across multiple activities. The figure of over 20 organizations refers to the number of targets, not successful intrusions in all cases.
  • Confirmed Data Theft or Session Compromise: Public Information: Reported theft per incident, such as GTG-20006 acquiring emails from at least 8 organizations, and parts of GTG-50014 acquiring data from roughly 200 downstream customer organizations. 1.8 million APKs represents the number of targets analyzed, not the number of compromised organizations or valid secrets.
  • Confirmed Subsequent Compromise: Public Information: Some incidents involved acquiring downstream customer data using SaaS providers as a foothold, as well as extortion. The contribution of AI and human intervention ranges follow descriptions per incident, and activities are not treated as fully autonomous.

10. Investigation Playbook

Trigger

  • Access to numerous resources and tenants in a short time using the same credentials, or unknown device registration following device code authentication.

Initial Verification

  • Determine the initial credentials, worker/IP, target scope, API speed, and failure/retry patterns.

Endpoints / Servers

  • Check not only known malware names but also behaviors, persistence, halted security updates, and matching C2 families.

Authentication / Cloud

  • Correlate API key, PAT, and token issuance and usage, privilege escalation, added authentication keys/devices, service accounts, and access to downstream tenants.

Subsequent Operations

  • Confirm bulk extraction of emails, session info, and databases, OAuth access to customer environments, transmission to external temporary storage, and leaked information used for extortion.

Containment

  • Revoke compromised sessions and tokens, and reissue exposed credentials following issuer procedures. Remove unauthorized device registrations, authentication keys, and service accounts, and notify impacted customers in accordance with organizational incident response procedures.
  • Apply outbound traffic restrictions, API rate limits, and behavioral rules, deploying detections beyond simple hashes.

Judgment Categories

  • Differentiate secret exposure, validity checks, initial authentication, privilege escalation, bulk data extraction, and downstream compromises.

11. Defense and Detection Ideas

Single Event

  • Inference: Enumeration of numerous resources and tenants using a single token from a new EC2/IP.
  • Inference: Unknown device registration and bulk email extraction immediately following device code authentication.

Time-Series Correlation

  • Inference: Correlate suspicious credential usage, authentication, token issuance, privilege escalation, bulk extraction, and downstream tenant access. Attacker-side secret discovery and validity checks may not leave traces in internal logs.

Threat Hunting

  • Inference: Match the location management of secrets originating from APKs, repositories, and containers with unknown real-world usage sources.

Log Shortages

  • Without records of token IDs, permissions, device registrations, and the targets/tenants of API operations, tracing the scope of a compromise or a sequence of actions becomes difficult. These logs alone cannot conclusively determine the presence of AI usage.

Priority Countermeasures

  • Inference: Prioritize preventing secret exposure, shortening secret lifespans, restricting authentication paths, auditing tokens and permissions, and monitoring bulk API operations.

12. Facts / Inference / Hypothesis

Facts

  • Anthropic's report covers abuse cases blocked by the company between December 2025 and August 2026, including numerous activities where AI directly executed reconnaissance, vulnerability exploitation, and data theft via multi-agent workflows.
  • GTG-20006 is a Russian-speaking espionage activity aligned with Midnight Blizzard that targeted over 20 organizations, where AI agents automatically modified, rebuilt, and repeatedly re-deployed malware to evade detection whenever it was caught.
  • GTG-20006 compromised at least three hotel guest Wi-Fi providers, distributing malware for Windows, Android, and iOS via DNS hijacking and ClickFix, while also acquiring emails from at least 8 organizations through device code phishing.
  • GTG-50014 operator frkoo used 10 AWS EC2 workers to acquire and decompile 1.8 million APKs, discovered secrets using TruffleHog, categorized them into over 100 types, and sent them to Telegram. Parallel GitHub collection also yielded PATs.
  • Another GTG-50014 operator acquired data from roughly 200 downstream customer organizations starting from a compromise of a SaaS provider. For an incident where over 2,100 Azure AD tokens spanning more than 40 tenants were acquired in approximately 34 hours, Anthropic explained that AI handled nearly all the work.
  • In another incident involving an enterprise software company, a single developer token led to organization-wide administrative privileges in about three hours.
  • Anthropic suspended related accounts, enhanced protective measures, and shared information with authorities and industry partners as necessary. Anthropic's own infrastructure was not compromised, and the API keys used were stolen from customer environments.

Inference

  • The speed and scale of intrusions are diminishing as reliable indicators of attacker headcount or traditional skills, requiring SOCs to view automated workflow iteration and parallelism as new clues.
  • It is critical to continuously inspect APKs, repositories, containers, and client code for exposed secrets and to tightly scope lifespans and permissions.

Hypothesis

No additional hypotheses. Unconfirmed items are noted under "Unknowns and Further Investigation."

13. MITRE ATT&CK Mapping

  • T1592 Gather Victim Host Information (Confidence: medium): Corresponds to reports of investigating target email and remote access system characteristics to select attack targets.
  • T1528 Steal Application Access Token (Confidence: high): Collected API keys, PATs, and Azure AD tokens from APKs, GitHub, and SaaS.
  • T1098.005 Account Manipulation: Device Registration (Confidence: medium): Corresponds to registering attacker-controlled devices to compromised accounts to maintain access.
  • T1098.001 Account Manipulation: Additional Cloud Credentials (Confidence: high): Corresponds to adding authentication keys to existing cloud accounts to maintain access even after original credentials are changed.
  • T1114.002 Email Collection: Remote Email Collection (Confidence: high): Bulk-exported emails from multiple organizations following device code phishing.
  • T1562.001 Impair Defenses: Disable or Modify Tools (Confidence: high): Monitored detection status, automatically modified malware, and halted security updates.

14. Unknowns and Further Investigation

  • Victim organization names, complete intrusion timelines, and financial damages per incident.
  • Product names and patch statuses for unknown vulnerabilities discovered and exploited by GTG-10007.
  • AI workflow, account, and API usage patterns beyond publicly released IOCs.
  • The exact proportion of public incidents where AI dictated intrusion success and the specific frequency of human operator intervention remain unknown.

15. Impact on SOCs and Organizations

Even within domestic organizations, embedding secrets in public APKs or repositories, or granting excessive permissions in SaaS integrations, can serve as a foothold for intrusion. SOCs track incidents from credential usage to privilege escalation and data retrieval, verifying impacts across multiple tenants. Rather than classifying high-speed operations solely as AI attacks, containment is driven by observed behaviors.

16. Summary by Role

  • SOC: Correlates high-speed, parallel API operations with the same objective, post-failure auto-corrections, secret verification, multi-target access using tokens, and bulk exports.
  • Administrators: Implements short-lived, least-privilege API keys, inspects APKs, repositories, and containers for secrets, controls device code authentication, and audits downstream tenant permissions.
  • Users: Checks for device code prompts, ClickFix, and hotel Wi-Fi update requests, and reports suspicious authentications or device registrations.

Top comments (0)