Developers just got another reminder that once a secret ships inside an application, an attacker may not need to breach a server to find it.
Anthropic says a French-speaking threat actor used a distributed system to download, decompile, and scan 1.8 million Android APKs for hardcoded credentials and other secrets, using tools including TruffleHog. BleepingComputer has linked the actor to the broader ShinyHunters ecosystem.
The operation shows how attackers can turn a familiar secure-coding mistake into an industrialized credential hunt, combining cloud infrastructure, automated security tools, and AI to identify potential paths into enterprise systems at scale.
The danger goes beyond developers accidentally exposing an API key. By combining AI with cloud infrastructure and automated security tooling, attackers could move much of the repetitive work of finding, validating, and using credentials from human hands into an automated workflow.
A 1.8 million-app credential threat hunt
According to Anthropic’s report, the operation ran for eight months, from December 2025 to August 2026. Over that time, the AI company says it discovered an unusual hacking pattern spanning 1.8 million distinct Android APK files downloaded from several stores.
The Anthropic threat intelligence team revealed that these APKs ran across 10 AWS EC2 workers, creating a distributed pipeline to inspect applications at scale.
The APKs were decompiled and scanned. A special pipeline sent relevant discoveries to Telegram channels in real time and sorted them into more than 100 categories, while another pipeline sent GitHub Personal Access Tokens (PATs).
The setup illustrates how cloud infrastructure, automated scanning tools, and AI can be combined to accelerate credential discovery across large software collections.
In one observed scenario, Anthropic says the attackers obtained more than 2,100 Azure AD authentication token sets from over 40 enterprise users in roughly 34 hours, while another intrusion progressed from a single stolen developer token to administrative control in around three hours.
The 1.8 million figure refers to APKs processed by the scanning pipeline, not 1.8 million confirmed compromised applications. The objective was to identify embedded secrets that could potentially provide access to developer or enterprise systems.
French-speaking actor linked to ShinyHunters ecosystem
The campaign also illustrates how credential theft can produce major compromises without relying on a novel software vulnerability.
Anthropic cited an operation by a French-speaking actor which BleepingComputer says is associated with the ShinyHunters ecosystem. Aliases used include frkoo, MeowSHA and blazespider.
The group was also not operating in isolation. Anthropic’s report also documented separate Russian- and Chinese-speaking threat activity involving Claude, although those cases were distinct from the Android APK scanning operation.
The Russian-linked activity took a different path. Anthropic associated one cluster with Midnight Blizzard, which used Claude for tasks including malware development, phishing, persistence, and data exfiltration, targeting government, defense, diplomatic, and intelligence organizations.
A separate Chinese-speaking group, tracked by Anthropic as GTG-10007, followed similar paths as the Russian group, using Claude for reconnaissance, vulnerability research, exploit development, and intrusion attempts.
Anthropic says it banned the compromised accounts and tightened Claude’s guardrails, using the incident as feedback to disrupt the attack. The Claude maker also noted it reached out to law enforcement.
The warning extends beyond app developers
For years, attackers have decompiled APKs to modify apps, bypass paywalls, or add features that developers never intended to ship. This campaign shows that the same ability can be used for something more serious.
That should push developers, vendors, and organizations to treat anything the public can legitimately obtain as potentially inspectable by an attacker. That applies not only to mobile apps, but also to websites, browser extensions, desktop software, scripts, public repositories, container images, and other software artifacts.
The same principle can extend to hardware. If attackers can reverse-engineer software to uncover weaknesses and credentials, hardware that relies on firmware, embedded software, and exposed interfaces can also become an entry point.
For developers and vendors, the response should cover more than keeping secrets out of code:
- Move sensitive operations off the device. Anything that requires privileged credentials should happen on infrastructure a public user cannot download or inspect.
- Audit what you actually ship. Review production builds, source maps, configuration files, debug endpoints, and bundled dependencies, not just the application’s source code.
- Design for credential failure. A stolen token should have limited permissions, a short useful lifetime, and no unnecessary access to unrelated systems.
- Watch for abuse after release. Track unusual API calls, authentication attempts, token use, and access patterns so you can detect an exposed credential rather than discover it months later.
- Treat suppliers as part of the attack surface. Review the SDKs and integrations you use, both for what they can access and what they expose.
For security teams, the larger lesson is that application release should be treated as a potential disclosure boundary. Anything packaged into downloadable software may eventually be inspected, extracted, and automated against.
That makes secret scanning, credential rotation, least-privilege access, and production-build review more than development hygiene. Once attackers can automate discovery across millions of applications, a single forgotten credential can become the shortest route from a public app to a private enterprise system.
More cybersecurity news: IDScan confirmed unauthorized access to customer data in its cloud after reports linked the identity-verification provider to more than 153 million driver’s license records offered on the dark web.