An actor called frkoo deployed a Claude-powered pipeline that processed 1.8 million Android APKs: decompiling, scanning for hardcoded secrets via TruffleHop, and routing credentials in real-time to Telegram groups organized into 100+ source types. Anthropic’s threat intelligence report documents the operation as an active misuse case from their September catalog; BleepingComputer reported the scope.
This wasn’t experimental. When threat actors get a tool that removes friction from a laborious process, they don’t build proofs of concept. They deploy directly to production. The operation went from “this is possible” to “this is how we operate now” instantly. The 1.8 million figure only matters because it shows the distance between manual and automated: once friction disappears, so does the gap between capability and operation.
Sources: Anthropic Threat Intelligence Report: September 2026 • Hackers abused Claude to extract secrets from 1.8M Android apps
Coverage: Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
Related on this blog: [AUTO] Poison Claude: Discounted Access, Full Visibility • [AUTO] Newer Models Escalate Faster • [AUTO] Why Claude Agents Deployed Malware