AI Agents Strip Secrets From 1.8M Android Apps: ShinyHunters Proved the Kill Chain Now Runs in Hours

Anthropic just published what eight months of watching threat actors use Claude looks like from the inside. Between December 2025 and August 2026, the company disrupted abuse by a financially motivated criminal collective and two state-sponsored espionage groups. One number should stay with every security leader on this continent: a ShinyHunters affiliate pointed AI agents at 1.8 million Android apps, and in 34 hours walked away with more than 2,100 Azure AD authentication tokens spanning over 40 corporate Microsoft tenants. In Anthropic’s words, “AI agents performed nearly all of the work.”

The APK dragnet is the part that matters most here

Android is how Africa banks. Nearly every fintech wallet, merchant acquiring tool, and telco service in this market ships as an APK, and most of them get decompiled by curious teenagers before they get decompiled by criminals. What ‘frkoo’, an alleged French-speaking member of ShinyHunters, did at industrial scale is what any competent attacker can now do at hobby scale.

The pipeline ran across ten AWS EC2 workers. It mass-downloaded 1.8 million distinct APKs from multiple app-store sources, decompiled them, and scanned the output for hardcoded secrets with TruffleHog. Verified findings went to a Telegram group organized into over 100 source-type channels, in real time. The same actor ran a second automated process that harvested GitHub organization email addresses and used them to obtain personal access tokens. Anthropic says both pipelines supplied the initial-access credentials behind the bulk of frkoo’s confirmed breaches.

The rest of the actor’s profile is unsettling. He set up a carding site at policenationale[.]cc, impersonating the French national police, selling stolen payment-card records alongside an interactive map of victim addresses. Suspected ShinyHunters members also stole AI API keys and spent them on follow-on intrusions. One breach of a software-as-a-service provider left data belonging to around 200 downstream customers in the wrong hands.

The clock is the story

Read the timings again if you only remember one thing from this report. After a suspected ShinyHunters actor got initial access to an enterprise software firm, bulk data theft began within hours. In another case, a single stolen developer token became full administrative control in less than three hours. The 2,100 Azure AD tokens came out of roughly 34 hours of agent-driven work.

Human-speed response does not match that clock. Most security programs are still built around the assumption that an intruder needs days to move, because that has been true for most of the last decade. That assumption is expiring.

State actors automated the whole kill chain

Anthropic’s report also covers Midnight Blizzard, the Russian military intelligence unit, using Claude to automate malware development, infrastructure acquisition, phishing, persistence, command-and-control, and exfiltration. The group built a feedback loop that rebuilt its malware whenever security products detected it, and targeted over 20 government, defense, diplomatic, and intelligence entities. The toolkit included device-code phishing, ClickFix attacks, DNS hijacking through compromised hotel Wi-Fi providers, and WhatsApp account takeovers. Human operators mostly just refined the Claude Code skills the workflows ran on.

Then there is GTG-10007, a Chinese-speaking espionage group that used the model as the engineering and orchestration layer of a full offensive program. Its autonomous vulnerability-research workflows ran while the human operators were away, uncovered multiple previously unknown vulnerabilities in a major security product, and delivered working exploits for several families of network and security appliances. The group targeted around 50 organizations, with confirmed compromises at an education-technology company, a retailer, and a Southeast Asian government agency.

What African enterprises should do this month

Treat every published APK as attacker input. Wire secret scanning into your build pipeline, rotate anything the scanner finds, and assume a decompiler will eventually read your code. A hardcoded key in a shipping app is a breach with a timer on it.

Tighten the token estate. Scope personal access tokens, expire them, and alert on creation and unusual use. Audit OAuth app grants and service principals in your Microsoft tenant on a schedule, because the ShinyHunters playbook shows how one quiet developer token becomes admin in under three hours.

Rework detection for machine-speed post-compromise activity. If your alerts fire on anomalous logins but nothing on token issuance spikes or bulk app-consent grants, you will detect a three-hour escalation three days later. And put network segmentation where a stolen edge credential cannot reach everything it wants to.

That is exactly where eHawu operates: network-layer controls that contain what a breached credential can touch, so a stolen token is a bad Tuesday instead of a regulator letter. When AI agents do the attacker’s tedious work at 3am, the defense has to move at the same speed, and it has to start at the network layer.