Hackers Used AI to Scan 1.8 Million Android Apps for Hidden Secrets

Cybercriminals are increasingly using AI to automate large-scale cyberattacks, with one operation reportedly analyzing 1.8 million Android application packages in search of exposed credentials and other sensitive information.

A new report from Anthropic highlights how threat actors are exploiting artificial intelligence to accelerate cybercrime, including the automated discovery of credentials hidden inside mobile applications.

According to Anthropic, a threat actor associated with the ShinyHunters cybercrime ecosystem operated a pipeline that downloaded 1.8 million Android APK files from multiple application sources. The applications were then decompiled and scanned for hardcoded secrets such as credentials, API keys and other authentication information.

The operation reportedly used multiple cloud-based workers to process the applications at scale. Once potentially valuable secrets were identified and verified, the findings were automatically organized and sent to a Telegram group.

AI helped attackers move much faster

The Android application campaign was only one part of a broader pattern identified by Anthropic between December 2025 and August 2026.

The company says threat actors used its Claude AI systems for activities ranging from reconnaissance and malware development to phishing, credential theft and data exfiltration.

In another case linked to suspected ShinyHunters activity, AI-assisted workflows reportedly helped attackers obtain more than 2,100 Azure authentication tokens associated with more than 40 Microsoft tenants in roughly 34 hours.

Anthropic said AI agents carried out nearly all of the work in that operation, demonstrating how automation can dramatically reduce the time required to move from initial access to broader compromise.

Android apps can unintentionally expose credentials

The incident also highlights a long-standing security problem for mobile developers: secrets embedded directly inside application code can potentially be extracted through reverse engineering.

API keys, tokens and other credentials should therefore not be treated as secure simply because they are contained inside an APK. Developers should use appropriate server-side controls, rotate exposed credentials and avoid placing sensitive authentication material directly in client-side applications whenever possible.

AI-powered attacks extend beyond Android

Anthropic's report describes several other campaigns in which threat actors allegedly used Claude to automate different stages of attacks.

The Russian-linked group known as Midnight Blizzard reportedly used AI-assisted workflows for malware development, phishing, infrastructure operations, persistence and data theft. Anthropic also described activity attributed to a Chinese-speaking group that used AI for vulnerability research, exploit development and reconnaissance.

The company says it disrupted the accounts involved, strengthened its detection and safety systems, and notified relevant authorities, industry partners and affected organizations.

What this means for developers

The episode is another warning that attackers can now automate tasks that previously required significant manual effort.

For Android developers and organizations, the key lessons include:

• Avoid hardcoding sensitive credentials in APKs.
• Regularly scan application builds for exposed secrets.
• Revoke and rotate credentials if they are accidentally published.
• Treat APKs as potentially reverse-engineerable.
• Monitor unusual use of API keys and cloud credentials.
• Add stronger authentication and server-side authorization controls.

The bigger concern is not simply that AI can help hackers write code. AI can allow attackers to perform repetitive discovery and reconnaissance tasks at a scale that would be difficult to achieve manually.

Source: Anthropic / BleepingComputer. This article has been independently redrafted for publication.