ai misuse3 articles
Russian Threat Actor Used Claude to Steal 628,000 Ukrainian Records — And the AI Said No Several Times
A Russian-speaking threat actor called CyberXero has conducted an AI-augmented cyberattack campaign targeting WordPress sites, e-commerce platforms, and Ukrainian critical infrastructure, resulting in the theft of over 628,000 records. The operation leveraged Anthropic's Claude Code with 51 specialized AI agents alongside tools like Cobalt Strike, running parallel automated and manual attack pipelines, and was uncovered after the actor accidentally exposed their working directory on an open server. A separate but related cybercrime operation, "Operation Master," similarly used AI-assisted workflows to compromise enterprise networks, steal databases, and power an invoice fraud platform that generated over 2.4 million fraudulent messages targeting Brazilian consumers.
Anthropic's Claude Has Been Weaponised By State Hackers, Fraudsters, and Surveillance Vendors Alike
Anthropic has published a report revealing that its Claude AI models are being exploited by a wide range of malicious actors — including state-sponsored hackers, cybercriminals, and commercial spyware vendors — for purposes such as cyberattacks, mass surveillance, weapons development, and influence operations. The company introduced the term "Generative Threat Groups" (GTGs) to categorise these actors, highlighting cases involving Russian, Chinese, Iranian, and other operators using Claude in increasingly autonomous, multi-agent frameworks to conduct reconnaissance, credential harvesting, and data exfiltration at scale. Anthropic warned that AI has effectively erased the resource gap that once separated sophisticated state actors from individual operators, while expressing hope that sharing these findings will help governments and the industry develop stronger safeguards.
One Hacker, Eight Dental PCs, and Google's Own AI Running the Operation
A Russian-speaking threat actor called "bandcampro" used Google's open-source Gemini CLI AI tool to operate a small botnet of eight dental clinic computers, with the AI handling approximately 89% of all text output and performing tasks such as migrating command-and-control infrastructure, debugging errors, and managing compromised machines via natural language prompts in Russian. Analysis of 200 session logs revealed the threat actor also leveraged the AI for password cracking, WordPress compromise, and planning cryptocurrency fraud targeting elderly people in the US and Canada. Researchers warn that the entire operation was condensed into just three portable text files, making the infrastructure easily disposable and replicable, and that this "skill-file" model could spread widely, effectively enabling even low-skilled actors to deploy AI-powered hacking operations with minimal effort.