Artificial intelligence is helping businesses automate tasks, analyze data and work more efficiently. Unfortunately, cybercriminals are using the same technology to speed up their attacks.
According to a recent report from Anthropic, threat actors associated with the ShinyHunters cybercrime group used Claude to support credential theft, data exfiltration and other malicious activities. One of the alleged members created an automated system that downloaded and analyzed around 1.8 million Android app packages looking for exposed credentials, tokens and API keys.
The incident shows a big shift in the cybersecurity landscape: AI is not creating new attack methods, but it’s allowing criminals to do old attacks much faster and bigger.
How Hackers Scanned 1.8 Million Android Apps
Anthropic found a French-speaking threat actor who operated under several aliases and was part of ShinyHunters.
The attacker created a credential-harvesting pipeline across 10 Amazon Web Services EC2 workers. The system downloaded 1.8 million Android APKs from multiple app stores, decompiled them and scanned the code for hard coded secrets using a credential-detection tool called TruffleHog.
Verified findings were then sent to a Telegram group and organized into more than 100 categories.
These exposed secrets could be:
- API keys
- Authentication tokens
- Cloud service credentials
- Database credentials
- Session tokens
- Developer access tokens
- Other sensitive information embedded in the app code
The same threat actor also created an automated process to collect email addresses of GitHub organizations and get GitHub Personal Access Tokens. Anthropic reported that these two pipelines supplied the initial-access credentials for most of the confirmed breaches attributed to the attacker.
The Numbers Show How Fast AI-Powered Attacks Can Scale
The 1.8 million Android apps are just one part of the activity described in the report.
Anthropic also reported that suspected ShinyHunters affiliates:
- Compromised a SaaS provider and extracted data from around 200 downstream customer organizations.
- Got more than 2,100 sets of Azure Active Directory authentication tokens for over 40 corporate Microsoft tenants.
- Completed the token-theft operation in around 34 hours, with AI agents doing almost all the work.
- Exfiltrated more than 1TB of data from a tech provider.
- Accessed airline systems with tens of millions of passenger records. Went from one stolen developer token to full admin control of a victim’s cloud environment in around 3 hours.
- Used one stolen AI API key for about 3 weeks to conduct more attacks.
Anthropic also saw Russian state-linked actors using Claude in campaigns against more than 20 government, defense, diplomatic, intelligence and foreign-policy organizations. A separate Chinese-speaking espionage group targeted around 50 organizations across healthcare, finance, energy, manufacturing, technology, education and government.
These numbers show how AI can reduce the time and technical effort to go from finding a weakness to exploiting it.
This Was Not a Claude Breach
It’s important to distinguish between an AI platform being breached and criminals using an AI platform.
Anthropic said its own systems were not breached in the ShinyHunters activity. Instead, attackers used Claude as a tool to automate existing cybercrime techniques. Some of the AI API keys used in the attacks were stolen from Anthropic customers’ environments.
Anthropic said it banned the accounts associated with the activity, added more detection and disruption measures and worked with authorities, industry partners and affected organizations.
But the incident still highlights a growing concern for businesses. Criminals can use AI to analyze unknown systems, write and adjust scripts, find valuable information and repeat tasks at a scale that would have taken much more time and expertise before.
Why Hardcoded Credentials are a Big Risk
Hardcoded credentials are passwords, keys, tokens or other sensitive values embedded directly in the application’s source code or configuration files.
Developers may embed them temporarily during testing or use them as a convenient way for an application to connect to another service. If those credentials remain in the final application, attackers can recover them by downloading and decompiling the app.
One exposed credential can give access to a much larger environment. Depending on the permissions, an attacker can use it to access cloud infrastructure, customer records, internal development systems, databases, connected applications or administrative functions.
The risks get even bigger when organizations:
- Reuse credentials across different systems.
- Give accounts more permissions than they need.
- Don’t rotate keys and tokens regularly.
- Store secrets in application code or public repositories.
- Don’t monitor when or where credentials are being used.
- Allow vendors to keep unnecessary access to customer environments.For software providers, managed service providers and other businesses with access to multiple customer environments, one compromised credential can also create a supply-chain risk.
What to Do Now
You don’t need an Android app to learn from this. The bigger lesson applies to any business that uses cloud platforms, Microsoft 365, third-party applications, APIs, software repositories or outsourced technology providers.
Businesses should:
Find Exposed Credentials
Review source code, public repositories, mobile applications, configuration files, documentation, scripts and cloud environments for exposed credentials. Automated secret-scanning tools can help find information that was missed.
Rotate Sensitive Keys and Tokens
Any credential that was exposed should be revoked and replaced. Businesses should also have a regular rotation schedule for API keys, access tokens, service accounts and other privileged credentials.
Apply Least Privilege
Accounts and applications should only have the minimum permissions required to do their job. Limiting access reduces the damage an attacker can do with a stolen credential.
Strengthen Identity
Require multi factor authentication wherever possible, restrict administrative access, review inactive accounts and monitor for unusual login locations or activity.
Monitor 24/7
AI-assisted attacks can go from initial access to data theft in a matter of hours. Continuous monitoring can help detect unusual authentication activity, privilege escalation, unauthorized exports and other warning signs before the damage spreads.
Evaluate Third-Party Risk
Businesses should know which vendors have access to their systems and data. Security reviews should include how those providers store credentials, manage privileged access, monitor their environments and respond to incidents.
Test the Environment
Regular vulnerability assessments and penetration testing can find exposed credentials, misconfigurations, excessive permissions and other weaknesses before an attacker does.
Businesses Must Prepare for Attacks at AI Speed
“Cybercriminals no longer need a big team to analyze thousands of applications or unknown systems one at a time. AI lets them automate that work and act on exposed credentials in hours not weeks. Businesses need continuous monitoring, strong identity controls and a tested incident response plan that can operate at the same speed as the threats they face.”
— Antwine Jackson, President and Founder of Enitech
This is not a reason to avoid AI. It’s a reason to make sure your cybersecurity program accounts for how AI changes the speed, scale and accessibility of attacks. Businesses need layered protection that includes secure configurations, identity and access management, endpoint detection and response, 24/7 monitoring, employee awareness, vulnerability testing and a documented incident response plan.
Protect With Enitech
Enitech helps businesses protect their users, systems and sensitive data with managed IT services, cybersecurity solutions, endpoint detection and response, 24/7 Security Operations Center monitoring, penetration testing, Microsoft 365 support and business continuity planning.
With offices in Raleigh and Charlotte and clients across the US, Enitech serves businesses across multiple industries including healthcare companies that need to protect patient and operational data.
Contact Enitech to schedule a consultation or request a free penetration test.
