[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCaDt67CFNEWSqpF_zEmv3-7A9F0sF1KtBgRmfOKvVKQ":3},{"article":4,"iocs":58,"watch_terms":63,"solutions":64,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0988a72c-ba0b-4acf-aed8-dd0850623a81","Hackers abused Claude to extract secrets from 1.8M Android apps","hackers-abused-claude-to-extract-secrets-from-1-8m-android-apps-ed5e0e","Anthropic says multiple threat groups, including the financially motivated and state-sponsored espionage groups linked to Russia and China, tried to abuse its Claude AI model for malicious purposes. [...]","Multiple threat groups, including Russian and Chinese state-sponsored actors and the ShinyHunters collective, have abused Anthropic's Claude AI model for malicious purposes. Activities included scanning 1.8 million Android APKs for hardcoded secrets, automating malware development, and facilitating rapid data exfiltration and credential theft. The actors used AI agents to perform most of the work, enabling fast-paced attacks and reconnaissance.","Hackers used Anthropic's Claude AI to scan 1.8M Android apps for secrets and automate malware development.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-abused-claude-to-extract-secrets-from-18m-android-apps\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F11\u002Frobothacker.jpg","2026-09-11T20:19:09+00:00","2026-09-11T22:00:05.994343+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Claude","product",{"name":21,"type":22},"ShinyHunters","threat_actor",{"name":24,"type":22},"Midnight Blizzard",{"name":26,"type":22},"frkoo",{"name":28,"type":29},"AI","technology",{"name":31,"type":19},"TruffleHog","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[59],{"type":60,"value":61,"context":62},"domain","policenationale[.]cc","Carding shop impersonating French national police",[18,31],{"controls":65,"vendors":149},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":96,"name":97,"problem":98,"products":99},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":52,"name":125,"problem":126,"products":127},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[128,133,141],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":129,"product_name":130,"url":131,"description":132},"prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":165},"ai-powered-recon-hardcoded-secrets-in-android-apks-exploited-at-scale","AI-Powered Recon: Hardcoded Secrets in Android APKs Exploited at Scale","Threat actors leveraged Anthropic's Claude AI to automate the scanning of 1.8 million Android APKs, rapidly extracting hardcoded API keys, credentials, and secrets that developers had inadvertently embedded in their code. The root cause is a widespread configuration management failure — developers routinely commit sensitive secrets directly into application binaries, creating a persistent, scalable attack surface. AI tools dramatically lower the cost and time required for adversaries to mine this data at scale, turning what was once a manual, slow process into a near-instant mass reconnaissance operation. This matters because hardcoded secrets provide direct pathways into backend systems, cloud infrastructure, and databases, often with minimal additional effort from attackers.",[155,156,157,158,159,160,161,162,163,164],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SA-15: Development Process, Standards, and Tools","NIST SSDF PW.8: Archive and Protect Each Software Release","OWASP Mobile Top 10: M9 - Insecure Data Storage","OWASP ASVS V6: Stored Cryptography Verification Requirements","GDPR Article 32: Security of Processing (for exposed PII via leaked credentials)","NIST CSF DE.CM-4: Malicious Code Detection","ITIL Service Design: Information Security Management",{}]