Hackers Exploit Claude AI to Steal Data from 1.8M Android Apps

Key Takeaways

• A cybercriminal operation, potentially linked to ShinyHunters, leveraged Claude AI to automate the theft of credentials from 1.8 million Android applications.
• The attackers decompiled Android APKs and scanned them for hardcoded secrets, using AI to rapidly identify and prioritize valuable access keys.
• This campaign facilitated initial access into various enterprise systems, cloud services, and developer platforms.
• The incident highlights the critical risk of embedding sensitive credentials directly within mobile applications.

AI-Powered Credential Theft Targets Android Ecosystem

A sophisticated credential theft operation, reportedly connected to the ShinyHunters cybercrime syndicate, has been observed exploiting Claude AI to streamline the extraction of sensitive data from a vast array of Android applications. This large-scale campaign involved downloading, decompiling, and scanning approximately 1.8 million Android apps for embedded secrets.

The operation underscores a growing trend where AI-assisted methodologies significantly accelerate the process of converting exposed mobile application credentials into a rapid initial access vector for subsequent enterprise breaches.

Operation Details and Infrastructure

According to a September 2026 threat intelligence report from Anthropic described, a French-speaking threat actor operating under the monikers MeowSHA, frkoo, and blazespider orchestrated this campaign. The attacker utilized a network of ten AWS EC2 worker instances to conduct the operation.

This infrastructure was designed to collect Android APK files from various app store sources. Once acquired, the applications were decompiled, and their code was then analyzed using TruffleHog, a specialized tool for detecting exposed credentials, API keys, tokens, and other confidential information.

The workflow was engineered to identify verified secrets in real time, channeling the findings to Telegram channels categorized by over 100 source types. This meticulous organization enabled the operator to efficiently sort stolen credentials by type, thereby prioritizing keys that could grant access to critical resources such as cloud services, developer platforms, and enterprise systems.

Dual-Stream Credential Harvesting

Anthropic’s analysis revealed that the Android APK scanning pipeline was complemented by a second credential-harvesting stream focused on GitHub. In this parallel effort, the attackers gathered organization email addresses and searched for exposed GitHub Personal Access Tokens. Together, these two integrated pipelines furnished the initial credentials that fueled numerous confirmed intrusions linked to the operator.

The incident forcefully brings to light a persistent security vulnerability within the Android ecosystem: the practice of developers embedding sensitive values directly into mobile applications. API keys, cloud credentials, backend tokens, analytics secrets, payment service keys, and private endpoints can all be extracted from APK files because these applications are distributed to user devices. While obfuscation can impede analysis, it does not render a client-side secret immune to extraction.

Anthropic characterized this operation as part of a broader, financially motivated campaign, with suspected ties to ShinyHunters affiliates. The group is believed to have leveraged AI to enhance reconnaissance efforts, understand unfamiliar developer and authentication APIs, convert privileged tokens, develop bulk-export tools, and collect data across customer environments following successful compromises of SaaS providers.

In one documented instance, attackers exploited a stolen AI API key for approximately three weeks to facilitate secondary attacks against other organizations. Anthropic explicitly stated that the API keys used in these malicious activities were pilfered from customer environments and that Anthropic’s own systems remained uncompromised.

Beyond Credential Collection

The attackers’ activities extended beyond mere credential harvesting. Anthropic observed operators performing cloud key validation, session replay attacks, token amplification, CI/CD injection, database dumping, and cross-tenant data collection. In a notable supply-chain incident, the actors reportedly extracted data from around 200 downstream customer organizations. They succeeded in dumping over 2,100 Azure AD token sets across more than 40 corporate tenants within approximately 34 hours, with AI agents carrying out the bulk of the work.

Anthropic has taken action by banning accounts associated with the activity, enhancing its detection mechanisms, and coordinating with law enforcement, industry partners, and affected victims. This campaign serves as a stark reminder that AI can significantly reduce the time and specialized expertise required to transform publicly available mobile binaries into a searchable inventory of exploitable enterprise secrets.

What You Should Do

• Never Embed Long-Lived Credentials: Developers must eliminate the practice of embedding sensitive, long-lived credentials directly within client-side applications.
• Implement Server-Side Secret Management: All secrets should be securely stored and managed on the server side.
• Utilize Short-Lived Tokens: Employ short-lived tokens for authentication and authorization, minimizing the window of opportunity for attackers if a token is compromised.
• Apply Scoped Permissions and Application Restrictions: Ensure that any access granted is based on the principle of least privilege, with tightly scoped permissions and strict application-level restrictions.
• Enforce Usage Quotas and Continuous Monitoring: Implement usage quotas for API keys and other credentials, and maintain continuous monitoring for suspicious activity.
• Implement Immediate Rotation: Establish protocols for immediate credential rotation if exposure is suspected or confirmed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.