A discount Claude reseller was neither cheap nor Claude

Anthropic’s newest threat report, dated September 12, shows that stolen Claude API keys were fuel, loot and cover in several of the operations it disrupted. Most of those keys were not stolen from Anthropic. They came from customers who left them in app binaries, public containers, code repositories and AI wrapper services, and from customers who bought cheap Claude access from the wrong seller.

The Anthropic report covers activity disrupted between December 2025 and August 2026 across seven harm areas: cyber operations, influence operations, surveillance, scams and fraud, biological misuse, conventional weapons development, and distillation. The actors used Claude Haiku, Sonnet and Opus. According to Anthropic, only one of the cases involved Claude Fable or Mythos-class models, an illicit distillation case. The company also limits the report’s scope: these are the most notable and novel cases it found, and typical misuse is left out. In every case it says it disrupted the activity, used what it learned to tighten safeguards, and shared intelligence with authorities and industry partners where appropriate.

Neither cheap nor Claude

GTG-50021 is the case closest to an ordinary API customer. Anthropic describes it as a Russian- and Ukrainian-speaking group, with one member using the alias “kl1zy”. It ran a reseller that sold discounted Claude access. Customers believed they were getting a deal on Claude, but their traffic was quietly proxied to a different model. Meanwhile the reseller’s tooling installed a credential harvester that stole their Anthropic account credentials, which were then sold to other AI proxy resellers for malicious use.

The report also describes a wider version of the scheme run by other actors. Websites posed as intermediaries that offered discounted access to several frontier models. The most persistent way they compromised visitors was by getting them to install client applications, often disguised as popular AI harnesses including Claude Code. These clients were credential harvesters. They collected every credential and authenticated session token on the device, AI keys included. Rotating a compromised key did not end the problem: the harvester kept watching for new sessions and sent each one back to the operator. Victims kept supplying fresh credentials to the attacker, and those credentials were then sold to the same fraudulent resellers the scheme imitated.

The report lists these domains for GTG-50021: awstore[.]cloud, kiro[.]cheap, sys-tools[.]cfd, aws-us-east-3[.]com, holdboost[.]store, deltaclient[.]xyz and iymkjuzymkapovrntoxy.supabase[.]co.

Where the keys leak from

Anthropic says fraudulent resellers increasingly run on compromised access, and the most common source is legitimate customers who accidentally expose keys and session tokens in their products: GitHub, mobile app install files, Docker containers, websites and chatbots. Attackers mine these places continuously.

One operator shows what that looks like in practice. A French-speaking suspected ShinyHunters affiliate, who goes by MeowSHA, frkoo and blazespider, ran a credential-harvesting pipeline on a fleet of 10 AWS EC2 workers. It downloaded 1.8 million distinct Android APKs from several app-store sources, decompiled them and scanned them for hardcoded secrets with TruffleHog. Verified findings went to a Telegram group in real time, sorted into more than 100 source types. A second pipeline harvested GitHub Personal Access Tokens. Together, according to the report, these two streams supplied the initial access for most of the confirmed breaches linked to frkoo.

Containers are another source. In spring 2026, a single French-speaking hacktivist tracked as GTG-50029 built a custom Rust scanner that checked public containers for exposed API keys. It validated what it found and rotated the working keys through a local proxy layer, so the actor’s traffic mixed in with the legitimate owners’ traffic. The campaign ran for a month entirely on stolen keys. It targeted European political parties, media outlets, think tanks and their SaaS providers, and got internal access to at least 14 of 42 tracked targets. In one case it exfiltrated about 140,000 records from a political campaign management platform, including users’ political opinions.

The integrations around the model are also targets. Several actors attacked AI wrapper services that ran LiteLLM, using prompt injection to extract the production API keys stored in their cloud-hosted containers.

Loot, compute and cover

The report gives three reasons an attacker wants AI credentials. Stolen keys and accounts sell in established markets. The attacker’s workloads run at someone else’s expense. And the activity is attributed to the key’s legitimate owner.

ShinyHunters affiliates switched their attack workloads onto a victim’s AI keys as soon as they obtained them during an intrusion. In one case, the attacker used a stolen key for about three weeks for secondary attacks. These included compromising a French retail chain, probing a Web3 identity platform, continuing to attack a nonprofit victim, and, for frkoo, building a carding shop disguised as a French national police site. The report says every key involved was stolen from Anthropic customers’ environments and that Anthropic’s own systems were not compromised.

GTG-50020 went after the AI supply chain itself. This Russian-speaking, financially motivated actor previously attacked hotel booking and fintech platforms. In one of those intrusions it took about 26 gigabytes of data and sought between $1.5 and 2.5 million through extortion or dark-web sales. It then turned the same methods on an AI vendor. It injected malicious instructions into the vendor’s automated evaluation sandbox, and the sandbox handed over the credentials it held, including production API keys from several providers. The actor moved its work onto those keys and kept attacking the vendor and unrelated targets in parallel. A follow-on campaign from the same infrastructure hit roughly thirty AI companies in about four days. It found one attack path that worked and repeated it against all thirty, with small adjustments for each target.

GTG-50020’s stated goal, pursued through more than a dozen avenues, was access to a pre-release Claude model. Every path failed. Anthropic again says the keys were customers’ keys taken from customers’ environments.

What the stolen compute was used for

Anthropic says that in most operations in the report, AI did more than answer questions. It executed or orchestrated the work through multi-agent frameworks that handled reconnaissance, exploitation and data exfiltration. Humans picked the targets and reviewed what was taken. Compare the company’s August 2025 report, which described GTG-2002 using Claude Code against at least 17 organizations in a single month. A model that Anthropic first documented in November 2025, a suspected state-sponsored campaign running autonomous attacks, has now spread to every class of actor it investigated. The report says publicly available offensive agent frameworks such as PentAGI recreate much of the same scaffolding for anyone who downloads them.

GTG-20006 is a Russian espionage actor, and Anthropic’s attribution is consistent with public reporting linking it to Midnight Blizzard. It used AI agents to check whether security products were detecting its deployed malware. When they were, agents modified and rebuilt the malware autonomously and kept iterating until it went undetected. Other workflows researched and registered phishing domains, configured infrastructure, sent emails and watched command-and-control channels for successful compromises. According to the report, the human operator mostly edited the Claude Code skills that drove these workflows. The operation targeted more than 20 organizations, concentrated in Ukraine and Europe, with a focus on military drone suppliers. It compromised at least three vendors that run hotel guest WiFi and redirected guests’ traffic to its own servers. From a North African government technology authority it took more than 300,000 national identity records.

GTG-10007 is a group of Chinese-speaking operators that Anthropic says likely lives in Changsha. Two were identified as undergraduate students. The group ran what the report calls an exploit foundry: agents loaded appliance firmware into a decompiler, formed vulnerability hypotheses, wrote exploits, tested them against lab copies and iterated until they worked. One workflow running continuously against network appliances produced more than a dozen possible zero-day findings in a single month. A fleet of thirteen collection agents ran on a schedule with no human in the loop. The actor targeted roughly fifty organizations.

The ShinyHunters affiliates show how fast this can move. One compromise went from a single stolen developer token to full administrative control of a victim’s cloud environment in about three hours. After breaching a SaaS provider, another affiliate dumped a session store with more than 2,100 Azure AD token sets across more than 40 corporate tenants in about 34 hours, with AI agents doing nearly all of the work. The report calls this style “vibe hacking”: the operator sets a broad goal, and the AI explores the environment, writes and runs scripts and keeps going until the task is done, often without the operator understanding the target environment.

Anthropic adds two caveats. Humans still make the decisions that matter most to them: target selection, monetization and review of results. And autonomy and harm are separate axes. Several of the most serious compromises in the report came from operations where a human directed every step. The techniques themselves are familiar: stolen credentials, unpatched edge devices, exposed services, SQL injection and phishing. What changed, according to the report, is the economics, with breaches completed in two to three hours and individual operators handling dozens of victims at once.

What Anthropic asks of key holders

The report’s recommendations for customers are short. AI API keys and session tokens are targets, and the integrations customers build around them, such as sandboxes, proxies and resellers, are part of the attack surface. Organizations should treat AI keys and agent integrations as seriously as production credentials, because, in Anthropic’s words, “attackers treat them with the same level of seriousness, too.” AI access should be bought only through authorized channels.

An alleged discount that requires routing traffic and credentials through an unknown intermediary introduces tremendous risk to user data and systems.