Case anthropic-gtg-50021-fake-resellerLLMjackingWorldwide
GTG-50021: fake discounted-Claude reseller proxied traffic and stole Anthropic credentials
A Russian- and Ukrainian-speaking group sold cheap Claude access, silently routed buyers to other models and ran a credential harvester that captured Anthropic account logins for resale.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- Worldwide
- Target
- Customers buying discounted Claude access
- Severity
- High
- Triggered by
- GTG-50021 (operator alias kl1zy)
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
A Russian- and Ukrainian-speaking group sold cheap Claude access, silently routed buyers to other models and ran a credential harvester that captured Anthropic account logins for resale.
Impact: Buyers deceived about the model they used and had Anthropic credentials stolen; scale not published.
Who triggered it
Actor: GTG-50021 (operator alias kl1zy)
Attribution: Anthropic Threat Intelligence; Russian- and Ukrainian-speaking fraud group identified via infrastructure and handles.
Motive: Profit from fraudulent AI access sales and stolen credentials
How it happened
Attack vector: Fraudulent reseller front-end with hidden proxying and a credential harvester
Root cause: Demand for cheap frontier-model access and reuse of account credentials across reseller sites
Timeline
- Fraudulent reseller site proxies buyers to other models while harvesting Anthropic credentials
- Anthropic publishes indicators of compromise for the reseller operation
Response
Indicators of compromise published; Anthropic describes stolen and resold access as a growing trend.
Current status: Contained
Sources (open in a new tab)
- Anthropic September 2026 threat report anthropic.com
- Paubox on stolen AI access paubox.com
Cite this case
GTG-50021: fake discounted-Claude reseller proxied traffic and stole Anthropic credentials. AI Threat Watch, case anthropic-gtg-50021-fake-reseller, Sep 10, 2026. https://aithreat.io/cases/anthropic-gtg-50021-fake-reseller/
Permanent link: https://aithreat.io/cases/anthropic-gtg-50021-fake-reseller/