1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T2029,

A Russia-linked espionage crew ran monitoring agents whose entire job was to watch whether its implants had been flagged by antivirus products, and to rewrite and rebuild them automatically until they came back clean. Anthropic described the technique on September 10 as part of a set of intrusion operations it detected and disrupted, and it is the clearest published example yet of an attacker closing the loop that security vendors have relied on for two decades.

Key takeaways

An actor Anthropic tracks as GTG-20006, whose tradecraft it assesses as consistent with Midnight Blizzard, used agents to iterate on detected malware until it evaded security products, then staged the rebuilt payloads on disposable hosts.
A financially motivated cluster ran ten AWS EC2 workers that downloaded and decompiled 1.8 million Android APKs hunting for hardcoded secrets, and separately dumped more than 2,100 Azure AD token sets across over 40 corporate tenants in about 34 hours.
Stolen AI API keys are now an objective in themselves — one actor attacked roughly thirty AI companies in four days chasing access to a pre-release Claude model and failed every time.

Why the evade-rebuild loop breaks detection economics

The defensive model that static signatures support is a cost-imposition game. An attacker builds a custom implant, uses it until a vendor writes a detection for it, then pays to rebuild. Every cycle costs the attacker engineering time, and that delay is where defenders find victims before the damage compounds.

GTG-20006 removed the delay. Its agents monitored whether deployed tooling was being caught, and on a hit they modified and recompiled the artifact, retested it, and kept going until nothing fired. The human operator's main involvement was editing the skills that drove the workflows when they needed refinement. Anthropic's own framing is that capable adversaries can now bypass traditional detections faster than defenders can write and ship them.

The targeting behind the automation was conventional espionage. More than twenty distinct organizations appeared in the actor's planning and live operations — government ministries, embassies, think tanks and defense-industrial firms concentrated in Ukraine and Europe — with email and remote access systems scanned across more than two dozen Ukrainian government bodies. Drone supply chains drew particular attention: the actor bulk-exported mailboxes at two drone component makers and stole a complete software development kit for a drone vision system, spending days reverse-engineering its architecture, hardware bill of materials and supplier dependencies.

Reach was extended indirectly by compromising at least three vendors running hotel guest WiFi and rewriting DNS records so guest traffic resolved to actor-controlled servers. A separate intrusion at a North African government technology authority produced a credential database holding over 300,000 national identity records and commercial registry data covering more than half a million companies.

Credential discovery at industrial scale

A different cluster, linked to affiliates of the ShinyHunters collective, automated the front of the kill chain instead of the back. One French-speaking operator ran a distributed pipeline across ten EC2 workers that mass-downloaded 1.8 million distinct Android APKs from multiple app stores, decompiled them, and scanned the results for hardcoded secrets with TruffleHog. Verified hits streamed in real time into a Telegram group organized into more than a hundred categories by secret type, and a parallel harvester fed stolen GitHub personal access tokens into the same funnel.

What followed was fast. One compromise went from a single stolen developer token to full administrative control of a victim's cloud environment in roughly three hours. Another produced a session-store dump of over 2,100 Azure AD token sets spanning more than 40 corporate tenants in about 34 hours — work Anthropic says was performed almost entirely by AI agents. After breaching one software-as-a-service provider, operators used the foothold to pull data belonging to roughly 200 downstream customer organizations.

Unattended exploit research

A third group, operating from Changsha and including two undergraduates at a local university, built something closer to a factory. Firmware images were decrypted, unpacked and loaded into decompilers by agents that walked cross-reference chains, formed vulnerability hypotheses against a knowledge base curated over time, wrote exploit code, and tested it against lab copies of the target product, iterating until it worked. One workflow aimed at network appliances produced more than a dozen candidate zero-days in a single month.

The group ran what Anthropic calls agent swarms, with a lead agent decomposing reconnaissance and post-exploitation work across parallel subagents, and it kept persistent campaign memory so target lists, harvested credentials and standing instructions survived between sessions. Roughly fifty organizations were targeted across education, retail, energy, healthcare, finance and government.

AI keys became loot, compute and cover

The economics of stolen model access explain a lot of the rest. A working API key resells in established markets, runs the buyer's attack workloads at the victim's expense, and attributes the traffic to the credential's legitimate owner. One hacktivist campaign ran for a month entirely on stolen keys. ShinyHunters affiliates switched their own workloads onto victim keys as soon as they found them.

One Russian-speaking actor injected instructions into an AI vendor's automated evaluation sandbox to make it hand over the production keys it held, then reused the same playbook against roughly thirty AI companies in about four days. Its stated goal, pursued across more than a dozen routes, was access to an unreleased Claude model; every attempt failed. Another group sold discounted "Claude" access that quietly proxied traffic to a different model while installing a credential harvester on the buyer's machine.

The practical instruction is narrow: treat AI keys, sandboxes, proxies and agent integrations as production credentials, and buy model access only through authorized channels. Anthropic's write-up of the disrupted operations carries indicators of compromise, drew an extended thread on Hacker News, and includes a separate section on model copying that we covered in Anthropic's 200-million-exchange distillation findings.

FAQ

Were Anthropic's own systems breached?

No. In every case involving stolen model credentials, the keys came from customers' environments — exposed in code repositories, mobile app binaries, containers and vendor evaluation sandboxes. The actor that spent four days probing thirty AI companies for a pre-release model never got in.

Does this mean endpoint detection is obsolete?

Not obsolete, but the assumption behind it has weakened. Signature-based detection worked partly because rebuilding evasive tooling was slow and expensive for the attacker. When that rebuild is automated and runs unattended, defenders lose the tempo advantage and need behavioral and identity-side controls to carry more weight.

What should teams shipping AI agents do first?

Inventory every place a model credential lives — CI systems, mobile binaries, container images, third-party integrations and evaluation sandboxes — and rotate on the same schedule as production secrets. Prompt injection against an agent that holds keys is now a documented path to credential theft, not a theoretical one.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#threat-intelligence\",\"item\":\"https://ainewsway.com/tag/threat-intelligence\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/threat-intelligence#itemlist\",\"name\":\"#threat-intelligence Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/attackers-ran-agents-that-rebuilt-their-malware-until-scanners-stopped-catching-it-mty5x2pw\",\"name\":\"Attackers Ran Agents That Rebuilt Their Malware Until Scanners Stopped Catching It\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# threat-intelligence"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","threat-intelligence"]}],[["$","$L1e",null,{"articles":[{"id":"80845ec0-ff74-459a-9e1f-e1ae30361f5c","slug":"attackers-ran-agents-that-rebuilt-their-malware-until-scanners-stopped-catching-it-mty5x2pw","title":"Attackers Ran Agents That Rebuilt Their Malware Until Scanners Stopped Catching It","subtitle":"Anthropic's disrupted intrusion cases show automated evasion, 1.8 million decompiled Android apps, and stolen model keys used as attack compute","content":"$1f","excerpt":"A Russia-linked crew let agents iterate on flagged implants until detection failed. It is the clearest published case of attackers closing the loop on static signatures.","coverImage":"https://cdn.ainewsway.com/uploads/2026/09/13f490ef-5f18-4847-9a4c-eff4315d09a9.webp","coverImageCaption":"A panel on artificial intelligence and cybersecurity, the intersection where Anthropic says attacker automation is now outpacing detection engineering","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-09-12T09:08:34.212Z","viewCount":2,"likeCount":0,"readingTime":6,"isFeatured":false,"isBreakingNews":false,"metaTitle":"Attackers Use AI Agents to Rebuild Malware Past Detection","metaDescription":"Anthropic disrupted crews that rebuilt flagged malware automatically, decompiled 1.8M Android apps, and used stolen AI API keys as attack compute.","metaKeywords":["AI malware evasion","Anthropic threat intelligence","agentic cyberattacks","stolen API keys","ShinyHunters","Midnight Blizzard","AI agent security","zero-day automation"],"ogImage":null,"aiSummary":"A Russia-linked espionage group ran agents that watched whether its malware had been flagged by security products and rebuilt the implants until nothing fired, according to cases Anthropic disrupted and disclosed on September 10. Separate clusters decompiled 1.8 million Android apps to mine credentials and dumped 2,100 Azure AD token sets in 34 hours. The pattern inverts detection economics and makes stolen AI keys a primary target.","aiTags":[],"sentiment":null,"articleType":"ANALYSIS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-09-12T09:08:09.093Z","updatedAt":"2026-09-15T11:40:41.588Z","contentUpdatedAt":"2026-09-15T11:40:41.587Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"e2b5fffc-de32-42aa-86fe-c75f219d6b4b","name":"AI & Machine Learning","slug":"ai-ml"}],"tags":[{"id":"271605bb-d9d6-40ee-a396-c816dba07c07","name":"Anthropic","slug":"anthropic"},{"id":"7d146f87-ebfe-45c8-91d1-8214f0782462","name":"Claude","slug":"claude"},{"id":"b33b2800-95a4-4cc2-9cea-4a3b5111dca3","name":"Cybersecurity","slug":"cybersecurity"},{"id":"c3ea531c-0bd4-483a-8d99-b10d931913b2","name":"Supply Chain Security","slug":"supply-chain-security"},{"id":"0821c0ca-1390-4a31-a9f0-fb64b2a4c285","name":"Threat Intelligence","slug":"threat-intelligence"}],"translations":[{"id":"381b1a1c-ccda-428a-9db9-8de8824f4529","language":"ko","title":"공격자들, 백신이 못 잡을 때까지 악성코드를 재빌드하는 에이전트를 돌렸다","subtitle":"Anthropic이 차단한 침입 사례에서 자동 탐지 우회, 안드로이드 앱 180만 개 디컴파일, 탈취한 모델 키를 공격 연산 자원으로 쓴 수법이 드러났다","excerpt":"러시아 연계 조직이 탐지된 임플란트를 에이전트로 반복 수정해 탐지를 뚫었다. 공격자가 정적 시그니처의 순환 구조를 닫아버린 가장 명확한 공개 사례다.","metaTitle":"AI 에이전트로 악성코드 재빌드해 백신 탐지 우회","metaDescription":"Anthropic이 탐지된 악성코드를 자동 재빌드하고 안드로이드 앱 180만 개를 디컴파일하며 탈취한 AI API 키를 공격 연산에 쓴 조직들을 차단했다."},{"id":"ee0ea2ae-207b-4e59-a3bb-7f6cf857d39e","language":"ja","title":"攻撃者、検知されなくなるまでマルウェアを再ビルドするエージェントを稼働","subtitle":"Anthropicが阻止した侵入事案から、検知回避の自動化、Androidアプリ180万件のデコンパイル、盗まれたモデルキーの攻撃用計算資源化が明らかに","excerpt":"ロシア系の集団が、検知されたインプラントをエージェントに反復修正させて検知を突破した。攻撃者が静的シグネチャの循環を閉じた、最も明確な公開事例だ。","metaTitle":"AIエージェントがマルウェアを再ビルドし検知を回避","metaDescription":"Anthropicは、検知されたマルウェアを自動で再ビルドし、Androidアプリ180万件をデコンパイルし、盗んだAI APIキーを攻撃用計算資源に使う集団を阻止した。"},{"id":"428905dd-266c-429c-a98b-e3c9e7deeee8","language":"es","title":"Los atacantes usaron agentes para reconstruir su malware hasta que los antivirus dejaron de detectarlo","subtitle":"Las intrusiones desarticuladas por Anthropic revelan evasión automatizada, 1,8 millones de apps de Android descompiladas y claves de modelos robadas usadas como cómputo de ataque","excerpt":"Un grupo vinculado a Rusia dejó que sus agentes iteraran sobre implantes ya detectados hasta burlar los antivirus. Es el caso publicado más claro de atacantes cerrando el ciclo de las firmas estáticas.","metaTitle":"Agentes de IA reconstruyen malware y evaden la detección","metaDescription":"Anthropic desarticuló grupos que reconstruían malware detectado de forma automática, descompilaron 1,8 millones de apps Android y usaron claves de IA robadas como cómputo."},{"id":"a875e5fa-9c44-45fb-a6c2-69f4102835b7","language":"zh","title":"攻擊者用智慧體反覆重建惡意軟體，直到防毒引擎再也認不出來","subtitle":"Anthropic披露的被阻斷入侵行動顯示：自動化免殺、180萬個安卓應用被反編譯、被竊模型金鑰淪為攻擊算力","excerpt":"一個俄羅斯關聯團伙讓智慧體反覆迭代已被標記的植入程式，直到檢測失效。這是攻擊者閉合靜態特徵碼迴圈的最清晰公開案例。","metaTitle":"攻擊者用AI智慧體重建惡意軟體繞過檢測","metaDescription":"Anthropic阻斷了多個團伙：它們自動重建被檢出的惡意軟體、反編譯180萬個安卓應用，並把竊得的AI API金鑰當作攻擊算力使用。"}],"celebrities":[{"id":"0632936d-a299-490f-b5e5-dfa87ba3eaa0","nameKo":"Anthropic","nameEn":"Anthropic","slug":"anthropic","profileImage":"https://ui-avatars.com/api/?name=Anthropic&size=400&background=84CC16&color=fff&bold=true"}]}]}],"$L20"]]}]

#threat-intelligence

Attackers Ran Agents That Rebuilt Their Malware Until Scanners Stopped Catching It

Subscribe to Newsletter

#threat-intelligence

Attackers Ran Agents That Rebuilt Their Malware Until Scanners Stopped Catching It