DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

Six Hours, Thousands of Credentials: The Automation of Credential Harvesting

#aisecurity #credentialharvesting #cloudidentity #supplychain

Six Hours, Thousands of Credentials: The Automation of Credential Harvesting

A credential-harvesting operation described in Anthropic's September 2026 threat-intelligence report compressed work that once took weeks of preparation into a single working night. The attacker's infrastructure, left behind on a victim's cloud tenant, included a reconnaissance and credential-management framework with a front-end dashboard used to administer more than 23,800 harvested keys and API keys. The operators set the goal. Software did the reconnaissance, the build, the retries and the sorting.

What the report describes

Across the case studies covering December 2025 to August 2026, Anthropic's team describes a shift away from endpoint-focused infostealer work toward autonomous, agent-driven collection. In one operation, a financially motivated cluster deployed pre-configured agent instructions and markdown playbooks to run vulnerability scanning, troubleshooting and IP rotation with little human intervention, harvesting thousands of third-party credentials within about six hours using the victim's own cloud addresses to blend the traffic in.
Another financially motivated cluster, designated GTG-50014 and described as exhibiting behaviour associated with ShinyHunters, ran what the report calls vibe hacking: operators supply a general goal and the model handles environment reconnaissance, script generation and retry logic. The described workflow downloaded roughly 1.8 million distinct Android packages from app stores, decompiled them, scanned the results for hardcoded secrets with TruffleHog, and pushed categorised hits into Telegram channels. A second pipeline scraped GitHub organisation addresses to exchange for personal access tokens. In one intrusion the group extracted more than 2,100 Azure AD tokens spanning over 40 Microsoft tenants in roughly 34 hours, with almost all of the work attributed to AI agents. In another, the interval from a single stolen developer token to full administrative control of a cloud environment was under three hours.

Why the economics changed

The report frames the effect as uplift across speed, scale and depth rather than as the discovery of novel exploits. It also identifies a specific shift in what attackers value. Alongside passwords, SSH keys and database connection strings, the collection targets now include AI API keys, because stolen model credentials yield three returns at once: value on resale, use of the victim's compute, and a legitimate-looking identity to work from.
The report is careful about its own limits. The cases are selected as notable examples rather than as a representative sample of all misuse, the report is vendor-authored, and external researchers cannot access the account data, prompts, network indicators or enforcement records needed to reproduce the findings independently.

What defenders can act on

  • Treat secrets in CI/CD as the primary asset. The value of one stolen developer token is now measured in hours to full environment control, so short-lived tokens and workload identity beat long-lived static keys.
  • Detect bulk download and decompilation patterns. Publishing pipelines that pull very large numbers of packages have a signature; so does executing a secret scanner against an unusual corpus.
  • Watch OAuth grants and downstream tenants. An intrusion that expands through OAuth reaches every federated tenant, which is how the tenant-spanning token counts become possible.
  • Monitor identity-provider token issuance at scale. A burst of token issuance across many tenants is a higher-fidelity signal than any single suspicious login.
  • Baseline AI spend and key usage. Unusual consumption on a model API key is one of the few visible traces of stolen compute.

The honest limit

Anthropic notes that these are selected cases, that the activity was disrupted, and that some details are published with victim anonymity preserved. Independent verification of the reported token counts and timing is not available. The direction of the trend, however, is corroborated by other vendors' incident-response reporting, and the operational consequence is the same either way: a large credential store is now collectable within a single shift.

References

Top comments (0)