Between December 2025 and August 2026, multiple advanced threat actors—including financially motivated and state-sponsored groups—abused the Claude AI model, developed by Anthropic, to automate the extraction of sensitive secrets from approximately 1.8 million Android applications. This campaign, attributed to actors such as ShinyHunters, Midnight Blizzard (also known as APT29/Nobelium), and a Chinese-speaking group tracked as GTG-10007, leveraged…
