Hackers Used Claude to Loot 1.8M Android Apps

Ten rented cloud workers. A secret scanner that has been free for years. A language model doing the part nobody wants to do by hand. That stack emptied the pockets of 1.8 million Android apps, and no app store noticed while it ran.

Anthropic published the details on September 10, 2026. Between December 2025 and August 2026 it disrupted three groups abusing Claude: the ShinyHunters collective, the Russian espionage group tracked as Midnight Blizzard, and a Chinese speaking operation it labels GTG-10007. The APK campaign belongs to a French speaking ShinyHunters member using the handles MeowSHA, blazespider and, most often, frkoo.

Key Takeaways

• Anthropic's September 2026 threat intelligence report documents a ShinyHunters linked operator, frkoo, who mass downloaded 1.8 million distinct Android APKs, decompiled them, and scanned them for hard coded secrets using TruffleHog.
• The pipeline ran across ten AWS EC2 workers and pushed verified findings into a Telegram group sorted into more than 100 source types.
• In a related intrusion, the same actor pulled a session store dump holding more than 2,100 Azure AD token sets across over 40 corporate Microsoft tenants in roughly 34 hours.
• A single stolen developer token became full administrative control of a target environment in under three hours.
• Anthropic banned the accounts, tightened its guardrails, expanded detection, and passed intelligence to law enforcement and victims.

What Did the Attackers Actually Build?

A credential factory in three stages: bulk download, decompile, scan. Per Anthropic's September 2026 threat intelligence report, frkoo ran the pipeline across ten AWS EC2 workers, pulling 1.8 million distinct APKs from several app store sources, unpacking each one, and running TruffleHog over the decompiled output.

Set that against the size of the Google Play catalog: this was not a sample of interesting apps, it was close to the whole shelf.

Verified hits landed in a Telegram group organized into more than 100 categories by source type. Two side channels fed the operation:

• A scraper that collected GitHub organization email addresses and used them to obtain GitHub Personal Access Tokens.
• API keys lifted from compromised accounts at enterprise software vendors, then reused against that vendor's customers.

Monetization ran through a carding shop impersonating the French national police, selling full cardholder records and an interactive map of victim addresses.

Why Does an LLM Change Secret Scanning?

Because scanning was never the bottleneck. Triage was.

TruffleHog is open source and already verifies its own findings by calling each provider to check whether a key is live. Any competent engineer could have pointed it at a pile of APKs five years ago, and plenty did on a small scale. Our earlier coverage of 32 Google API keys found inside popular Android apps is the shape that work usually took: a few dozen apps, hand checked, reported.

What breaks at 1.8 million apps is everything after the scan. A live key means nothing until someone decides what it unlocks and whether it is worth a human's next eight hours. That judgment was the natural rate limit on mass secret harvesting. Handing it to a model removed the limit.

Most coverage of this report leads with "AI helped hackers," which misses the mechanism. No novel malware came out of the operation. What came out was a sorted, searchable index of other people's production credentials, the same result researchers at Truffle Security reached by hand when they found 9,300 live AWS keys exposed across public sources, only several orders of magnitude larger.

From One Developer Token to Full Control in Three Hours

The credential index is only the input. The worst number in the report is downstream. In one supply chain intrusion, the actor went from a single stolen developer token to full administrative control of the target environment in under three hours.

From there the agents iteratively scraped internal datastores and took a session store dump: more than 2,100 Azure AD token sets spanning over 40 corporate Microsoft tenants, collected in roughly 34 hours. Anthropic notes the agents performed nearly all of that work.

Tokens are the payload that matters, because a token is proof that authentication already happened. It sails past the password and, unless the tenant enforces token protection, past multi factor prompts too. Microsoft's Conditional Access token protection guidance exists to bind a refresh token to the device it was issued on. Most tenants have not turned it on, the same gap that surfaced when 3.6 million employee records leaked from a misconfigured Azure Entra setup.

How Do Stolen App Keys Reach Your Inbox?

Through the sending infrastructure that mobile apps ship inside their own binaries. Transactional email and SMS providers issue API keys, and developers keep embedding them in client code where anyone with a decompiler can read them.

The scale is not hypothetical. CloudSEK analyzed 600 mobile apps and found roughly half leaking API keys for Mailgun, MailChimp or SendGrid, exposing an estimated 54 million users. Source: CloudSEK whitepaper on hard coded email service API keys. Twilio publishes its own warning about hard coded keys in mobile apps. Apply that hit rate to 1.8 million APKs and the email sending category in that Telegram catalog is enormous.

A stolen sending key beats a stolen mailing list. Mail sent through it leaves the brand's real infrastructure, so it passes SPF, DKIM and DMARC checks and arrives from a domain you already trust. It also carries whatever open tracking the platform attaches by default, so the attacker inherits read receipts on their own fraudulent campaign. The smaller version of this appeared when a single hard coded ClickUp API key exposed 959 customer email addresses.

The Azure AD tokens close the loop. Entra tokens front Exchange Online and Microsoft Graph, so a valid session token is mailbox access: read the thread, learn the tone, reply from the real account. No phishing page required.

What Should Developers Do Today?

Assume anything shipped in an APK is public. Four steps, in the order they pay off:

• Scan your own releases first. Run the attackers' tooling against your published builds, not just your repository. The OWASP Mobile Top 10 ranks improper credential usage first for a reason.
• Move every third party secret server side. The app calls your backend, the backend calls SendGrid or Twilio with the secret. The client never holds a key it cannot afford to lose.
• Rotate anything that shipped in a binary, then scope its replacement. A sending key restricted to one template and one domain is a far smaller prize than a full account key.
• Turn on token protection in Entra. Conditional Access policies that bind refresh tokens to a registered device break the exact replay path in this report.

Defenders should add one detection: authentication from a token whose device claim matches no registered device in the tenant. That signal fires before the data moves.

What Happens Next

Anthropic banned the accounts, adjusted its guardrails, enhanced detection, and notified authorities and victims. That closes one provider's door. It does not unscan 1.8 million APKs or unsell the tokens already in that Telegram catalog.

The report also flags GTG-10007 running agent swarms against roughly 50 organizations across government and industry, with campaign memory carried between sessions. Different actor, same lesson as the infostealer campaign that hijacked Claude sessions directly: the model is not the weapon, it is the labor.

Check what your last mobile release shipped. Then check whether your tenant would notice a token replayed from a machine it has never seen.