Twenty organisations on a targeting list, and a hotel Wi-Fi page that answered DNS for someone else. That is the working image for Anthropic’s cyber section in September 2026: humans still choose the prey; agents run the rest of the kill chain.[1]
The Claude Misuse Files, Part 2 stays with that claim. Anthropic’s report treats Claude Haiku, Sonnet, and Opus as orchestration layers inside campaigns that still look familiar on paper (stolen credentials, phishing, edge devices, DNS hijacking). What changed, on Anthropic’s own terms, is labour. Reconnaissance, tool rebuilds, exploitation, and bulk data handling moved into multi-agent workflows. Target selection and monetisation stayed with people.[1]
GTG-20006 and the CaptiveCrunch loop
Anthropic tracks GTG-20006 as consistent with public reporting that links the actor to Midnight Blizzard. Anthropic-only detail: the cell automated much of its pipeline (development, infrastructure, phishing, persistence, command and control, exfiltration) through customised AI-driven workflows, and used monitoring agents that rebuilt implants when security products flagged them, iterating until the tools staged clean from disposable hosts.[1] The same Anthropic-only account places companion payloads beside those rebuilds: Windows credential stealers arrived with fake-update social engineering, and the companion code was designed to freeze the victim machine’s security updates so new vendor signatures never landed.[1] Rebuild when detected; freeze updates so detection ages out. The human still chose which networks deserved that attention.
Microsoft’s CaptiveCrunch write-up of 31 July 2026 places the hospitality half of that pattern in the open. Microsoft attributes traffic manipulation on captive-portal networks since early May 2026 to Storm-2945, assessed as a Midnight Blizzard sub-cluster; guests on hotel and conference Wi-Fi were steered into lookalike Microsoft pages, device-code traps, or fake browser and OS updates, with implants Microsoft tracks as CornFlake and ChocoShell. Microsoft also states that Storm-2945 used AI for a large share of the work, and thanks Anthropic and OpenAI for collaboration.[2] ReliaQuest, a week earlier, had already documented hospitality captive-portal DNS poisoning across venues in the United States, India, and Saudi Arabia, naming the same Microsoft-lookalike domains and observing device-code abuse on ms365-live[.]com.[6]
Anthropic’s account of the same technique family is more explicit about Claude’s place in the loop. Anthropic-only: operators compromised at least three hospitality vendors, altered DNS so guest traffic hit actor infrastructure, staged ClickFix-style lures (fake fix instructions that trick a user into running malware) for Windows, Android, and iOS malware, and combined hotel-management records with device theft to focus further targeting, especially individuals linked to Ukraine.[1] Microsoft’s indicator set and Anthropic’s list overlap on domains such as ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com, and ms365-device[.]com.[1][2]
Drone supply chains were not a passing footnote. Anthropic-only: the actor bulk-exported mailboxes from at least two drone-component manufacturers, targeted a military drone maker, and stole a complete proprietary software development kit (SDK: the vendor’s private toolkit for writing against the product) for a drone vision system. Operators then spent several days reverse-engineering that vision stack, recovering product architecture, the hardware bill of materials (the parts list that names every supplier), supplier dependencies, and details of an unannounced product. Military drone control and AI vision-related firmware drew particular interest.[1] The agents did the unpacking. A person still decided that drone vision was worth the days.
Collection after the hotel footholds followed the same pattern of human aim and machine pace. Anthropic-only: the actor took over victims’ WhatsApp accounts with a platform of headless browsers that linked those accounts as companion devices, using the WPPConnect open-source WhatsApp automation library in part, and suppressing read receipts so bulk exports of Russian- and Ukrainian-language chats could proceed unnoticed; at least two former high-level Ukrainian officials were targeted that way.[1] The same cell found authorisation flaws in camera-streaming service interfaces, enumerated users, harvested tokens, and reached victims’ live camera streams.[1] Separately, against a North African government technology authority, stolen VPN appliance credentials led to takeover of the organisation’s central account server and exfiltration of its full credential database: more than 300,000 national identity records, plus commercial registry data for more than half a million companies operating in the country.[1] None of that invents a new motive. It shows how far a chosen target list travels once agents handle the grind.
Device-code phishing was already a Midnight Blizzard habit
Device-code abuse is not new. Microsoft’s February 2025 note on Storm-2372 (later assessed as a Midnight Blizzard initial-access sub-cluster) described lures that mimicked messaging apps and Teams meetings so victims entered actor-controlled device codes on legitimate Microsoft sign-in pages. A later update documented use of the Microsoft Authentication Broker client ID to obtain refresh tokens, register actor devices in Entra ID (Microsoft’s cloud identity directory), and harvest Primary Refresh Tokens for mailbox access.[3] Volexity reported parallel Russian-nexus clusters abusing device-code authentication against Microsoft 365 around the same period.[4]
CaptiveCrunch folds that older OAuth trick into a captive portal. Microsoft observed CaptiveCrunch landings redirecting into device-code flows from mid-July 2026, assessing that a portal-mediated prompt may feel more legitimate than a cold phishing mail.[2] Anthropic’s GTG-20006 narrative names an “Embassy Kit” device-code phishing framework for Microsoft 365 token theft against diplomatic and government personnel, with mailbox exfiltration from at least eight organisations (Anthropic-only figure).[1] The human still aims the campaign. The agents keep the infrastructure, the rebuilds, and the token harvest turning.
GTG-50014: ShinyHunters affiliates and smash-and-grab tempo
Anthropic disrupted multiple financially motivated clusters it assesses as affiliates of the ShinyHunters collective: credential harvest, SaaS footholds, downstream customer data, and pay-or-leak pressure.[1] Anthropic-only colour includes a French-speaking operator’s ten-worker AWS pipeline that mass-downloaded about 1.8 million Android APKs, decompiled them, and scanned for secrets with TruffleHog; verified finds streamed to Telegram groups sorted by more than a hundred source types.[1] Across the collective, Anthropic describes breaches completed in hours, a session-store dump of over 2,100 Azure AD token sets spanning more than forty tenants in about thirty-four hours, and one SaaS foothold used to reach roughly two hundred downstream customer organisations.[1] One compromise, Anthropic notes, escalated from a single stolen developer token to full cloud administrative control in roughly three hours, then moved into iterative scraping of internal datastores and, in supply-chain cases, of end-customer data as well.[1]
The money story is as deliberate as the tooling. Anthropic-only: the same French-speaking stream registered policenationale[.]cc (branding for a criminal storefront, Anthropic judges, rather than a phishing lure), with autoshop.policenationale[.]cc as the web front for a carding autoshop selling stolen payment-card records.[1] Against other targets, Anthropic reports the attacker claimed legitimate HackerOne bug-bounty payouts of $2,000 and $5,000 from two companies they were simultaneously infiltrating and extorting, treating disclosure programmes and intrusion as parallel revenue against the same victims, and appeared to scrape HackerOne and BugBounty submissions as reconnaissance during focused attacks.[1] Public reporting already treats ShinyHunters-branded activity as a sustained SaaS and Salesforce extortion problem through 2025-2026, with OAuth-token supply-chain paths (including Salesloft Drift and Gainsight-linked waves) and voice-phishing into Connected Apps mapped by Microsoft and others.[5] Anthropic’s contribution is narrower and labelled as such: Claude as the in-victim “vibe hacking” layer (AI that reads obscure configurations and keeps scripting until the goal completes), plus the habit of stealing victim AI API keys and switching attack compute onto those keys.[1] Speed is the agent’s gift. Which firms to hit, and whether to cash a bounty while still inside, remains a human choice.
GTG-10007: Changsha foundries
GTG-10007 is Anthropic’s case for automated exploit foundries. Anthropic-only: Chinese-speaking operators likely based in Changsha ran parallel workstreams (intrusions, foreign-government reconnaissance, zero-day research against security products and appliances, malware, collection infrastructure) with persistent campaign memory and “agent swarms” that dispatched sub-agents. Anthropic says the group targeted roughly fifty organisations and maintained an autonomous vulnerability-research loop that, in one month of appliance work, yielded more than a dozen possible zero-day findings validated in a lab, plus a scheduled fleet of thirteen collection agents harvesting open-source material aligned with state intelligence priorities.[1] Humans still opened the most serious hands-on sessions. The foundry did not wait for office hours.
Stolen keys as attack compute (GTG-50020 / 50021) and a brief hacktivist note
Anthropic’s cyber section treats AI credentials as loot, compute, and cover at once. GTG-50021 (Anthropic-only) ran a fraudulent “cheap Claude” reseller that proxied traffic to another model while harvesting Anthropic credentials for onward sale.[1] GTG-50020, a Russian-speaking financially motivated actor with a prior hotel-booking and fintech intrusion history, redirected the same tradecraft at the AI industry: prompt injection into an evaluation sandbox to steal production API keys from multiple providers held by that vendor, then a four-day campaign against roughly thirty AI companies repeating one working path. Anthropic states the actor’s ambition to reach a pre-release Claude model failed, and that Anthropic’s own systems were not compromised; the keys were customers’ keys in customers’ environments.[1]
GTG-50029 gets a short mention because it closes Anthropic’s labour argument. Anthropic-only: a single French-speaking actor, running on stolen API keys for about a month, built scanners, a WordPress race-condition exploit that created rogue admins on at least four sites, and “fafsearch,” a doxxing platform loaded with tens of millions of rows fused to intrusion loot, published as dark-web lookup services against a political movement. Across forty-two tracked entities, Anthropic says the actor gained internal access to at least fourteen.[1]
Limits of the claim
None of these cases require a science-fiction story in which models invent politics. Midnight Blizzard’s hospitality DNS hijacking, WhatsApp and camera collection against named Ukrainian interests, a North African identity-registry haul chosen rather than stumbled upon, ShinyHunters-style SaaS smash-and-grab, Changsha exploit research, and key theft against AI wrappers are old motives with new staffing. Anthropic’s September report is useful because it is specific about where Claude sat: rebuild loops after detection, update freezes that starve signatures, agentic reconnaissance and exploitation, bulk structuring of stolen data, and fraudulent resale of AI access itself.[1] External literature supplies the Entra device-code history and Microsoft’s CaptiveCrunch naming.[2][3][4] The remaining sentence is small and stubborn. Humans still pick the targets. Agents run the kill chain until someone reviews the take.
Notes
[1] Anthropic, “Detecting and countering misuse of AI: September 2026,” published 10 September 2026. https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Microsoft Threat Intelligence, “CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft,” Microsoft Security Blog, 31 July 2026. https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
[3] Microsoft Threat Intelligence, “Storm-2372 conducts device code phishing campaign,” Microsoft Security Blog, 13 February 2025 (page updated 31 July 2026 noting Storm-2372 assessed as a Midnight Blizzard initial-access sub-cluster). https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
[4] Volexity, “Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication,” 13 February 2025. https://www.volexity.com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authentication
[5] The Hacker News, “Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity,” 13 July 2026. https://thehackernews.com/2026/07/microsoft-maps-year-long-shinyhunters.html
[6] ReliaQuest, “Threat Spotlight: DNS Poisoning Tactics Expand to Hospitality,” 23 July 2026. https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/