Case anthropic-gtg-30006-iran-toolingState actor AI opsWorldwide
GTG-30006: Iranian accounts built phishing portals and SECOMS64 implant with Claude
Free-tier Claude accounts spread across 16 organisations built phishing portals, a VBScript dropper, the SECOMS64 implant and Microsoft 365 mailbox-theft tooling, splitting work into small sessions to weaken safeguards.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- Worldwide
- Target
- Microsoft 365 mailboxes and phishing targets
- Severity
- High
- Triggered by
- GTG-30006 (Iran-nexus)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Free-tier Claude accounts spread across 16 organisations built phishing portals, a VBScript dropper, the SECOMS64 implant and Microsoft 365 mailbox-theft tooling, splitting work into small sessions to weaken safeguards.
Impact: Working phishing portals and an implant for Microsoft 365 theft produced; victim count not published.
Who triggered it
Actor: GTG-30006 (Iran-nexus)
Attribution: Anthropic assesses an Iranian nexus from targeting, language and infrastructure; specific unit not named.
Motive: Credential theft and mailbox access for intelligence collection
How it happened
Attack vector: Fragmented coding sessions on free accounts to obtain phishing kits, droppers and an implant
Root cause: Safeguards were weaker when malicious development was split into many small, individually benign-looking sessions
Timeline
- Accounts across 16 organisations develop phishing and implant tooling
- Anthropic bans the accounts and shares findings with partners
Response
Accounts banned; findings shared with partners; Anthropic flagged session fragmentation as an evasion pattern.
Current status: Contained
Sources (open in a new tab)
- Anthropic September 2026 threat report anthropic.com
- The Next Web coverage thenextweb.com
Cite this case
GTG-30006: Iranian accounts built phishing portals and SECOMS64 implant with Claude. AI Threat Watch, case anthropic-gtg-30006-iran-tooling, Sep 10, 2026. https://aithreat.io/cases/anthropic-gtg-30006-iran-tooling/
Permanent link: https://aithreat.io/cases/anthropic-gtg-30006-iran-tooling/