Reported campaign links Claude misuse to secret scans of 1.8M Android apps

APK collection and analysis across ten AWS workers

Anthropic says an alleged French-speaking ShinyHunters member distributed a credential-harvesting pipeline across 10 AWS EC2 workers. The pipeline reportedly obtained Android APKs from multiple app-store sources, decompiled them, and used TruffleHog to search for hardcoded secrets. Anthropic says the actor also used Claude in malicious activity, including extracting authentication data in another operation.

The report does not provide a comparable earlier collection count or processing scale for this operation.

The reported operation scaled secret-hunting to 1.8 million distinct Android APKs while using Claude in broader malicious activity attributed to the suspected actor.

The account describes automated collection and analysis at a scale of 1.8 million app packages, alongside claimed misuse of an AI model in intrusion-related work.