← Back to feed
2026-09-14 Malicious ToolNation StatePhishing TLP:CLEAR

Anthropic September 2026 Threat Report: State Actors Abuse Claude for Malware, Surveillance, and APK Scanning Campaigns

Date: 2026-09-14
Tags: malicious-tool, nation-state, phishing

Executive Summary

On September 13, 2026, Anthropic published its threat intelligence report covering December 2025 through August 2026, documenting abuse of Claude by Russian, Chinese, and financially motivated threat groups. A single actor created an automated pipeline scanning 1.8 million Android APKs for hardcoded secrets. Anthropic removed offending accounts and modified guardrails in response.

Campaign Summary

FieldDetail
Campaign / MalwareMulti-actor Claude abuse campaign
AttributionRussian state-linked actors, Chinese state-linked actors, ShinyHunters group, financially motivated operators (confidence: high)
TargetGlobal enterprises, Android app developers, financial systems, government infrastructure, surveillance targets
VectorAnthropic Claude API abuse for malware engineering, phishing development, surveillance platform construction, mobile app reconnaissance
Statusactive
First Observed2025-12

Detailed Findings

Anthropic documented threat groups including Russian and Chinese state-linked actors, as well as the ShinyHunters group, abusing Claude from December 2025 through August 2026 for cyber and influence operations, surveillance, and scams, with one actor using Claude to create a pipeline that scanned 1.8 million Android APKs for hardcoded secrets, with activity attributed to ShinyHunters and groups linked to Russia and China. Actors used Claude conversationally as an engineering assistant in creating malware, phishing kits, and surveillance tooling designed to freeze victim machines' security updates, used AI to fingerprint email and remote access systems and harvest information from public sources for building phishing target lists, and used AI to build and operate platforms running cyber intrusion campaigns. Anthropic removed the accounts and modified its guardrails.

MITRE ATT&CK Mapping

TechniqueIDContext
Malware DevelopmentT1587.001State actors and criminal groups using Claude API for iterative malware engineering and exploit development
PhishingT1566AI-generated phishing content and social engineering platforms built using Claude

IOCs

Domains

_Specific APK hashes and scanning tool identifiers not disclosed by Anthropic. 1.8 million Android applications affected by reconnaissance activities._

Full URL Paths

_Specific APK hashes and scanning tool identifiers not disclosed by Anthropic. 1.8 million Android applications affected by reconnaissance activities._

Splunk Format

_No IOCs available for Splunk query_

Affected Platforms

Android ecosystem
Anthropic Claude API

Detection Recommendations

Monitor for automated Android APK scanning patterns against public repositories indicating systematic reconnaissance for hardcoded secrets. Implement MFA and API key rotation on Anthropic Claude accounts, particularly for service accounts in development environments. Establish alerts for high-volume API usage patterns anomalous to legitimate development workflows. Monitor for suspicious phishing infrastructure that shows linguistic consistency with Claude outputs (specific writing patterns, structure markers). Conduct endpoint forensics on development machines to detect presence of surveillance frameworks built using Claude-generated code. Classify Claude API access as sensitive identity and implement zero trust principles similar to those applied to GitHub Actions, cloud provider APIs, and container registries.

References