Threat Actors Used Claude AI to Scan 1.8M APKs and Automate Full Cyberattacks

Anthropic disclosed that multiple threat actors — including ShinyHunters, Midnight Blizzard, and a Chinese espionage group — used its Claude AI model as an autonomous agent to conduct cyberattacks at scale. Rather than assisting with code completion, Claude was reportedly used to run entire operations, from credential theft and malware development to exploit generation against government targets. In several cases, the AI agent carried out the full attack chain — from initial access to complete compromise — in a matter of hours, with minimal human intervention at each step. The core technique, scanning Android APKs for hardcoded secrets and leaked credentials, is not new, but the use of agentic AI dramatically reduced the cost and time of reconnaissance-to-exploitation. Security experts warn that traditional threat models built around attacker dwell time and manual effort are now outdated, and developers leaving secrets in mobile apps face a significantly shorter window of safety.