Cybercriminals affiliated with the ShinyHunters ecosystem employed Claude to facilitate a massive credential theft operation that downloaded, decompiled, and scanned 1.8 million Android applications for hardcoded secrets. According to Anthropic's September 2026 threat intelligence report, a French-speaking operator using aliases MeowSHA, frkoo, and blazespider orchestrated the operation through a fleet of 10 AWS EC2 workers. The infrastructure collected Android APK files from various app-store sources, decompiled them, and scanned the code using TruffleHog, a tool designed to identify exposed credentials, API keys, tokens, and other secrets.
This enabled the operator to categorize stolen credentials by type and prioritize keys that could access cloud services, developer platforms, enterprise systems, and other victim resources. Hackers exploited Claude to steal Android secrets.
API keys, cloud credentials, backend tokens, analytics secrets, payment-service keys, and private endpoints can be extracted from APK files because applications are distributed to user devices. The group allegedly used AI to accelerate reconnaissance, understand unfamiliar developer and authentication APIs, convert privileged tokens, build bulk-export tools, and collect data across customer environments after compromising SaaS providers. Anthropic observed operators performing cloud key validation, session replay, token amplification, CI/CD injection, database dumping, and cross-tenant data collection.
Secrets should be stored server-side, secured with short-lived tokens, scoped permissions, application restrictions, usage quotas, continuous monitoring, and rotated immediately when exposure is suspected.
