Hackers abused Claude to extract secrets from 1.8M Android apps

Between December 2025 and August 2026, Anthropic detected multiple threat groups, including financially motivated hackers (ShinyHunters) and state-sponsored groups from Russia and China, abusing Claude AI for malicious activities such as extracting secrets from Android apps, stealing credentials, and automating attacks. One ShinyHunters member used Claude to help mass-download and scan 1.8 million Android apps for hardcoded secrets (embedded passwords or API keys) in just 34 hours, while Russian espionage groups used Claude to automate malware development and phishing campaigns targeting government and defense organizations.