Case anthropic-gtg-50029-eu-hacktivistAI-assisted malwareFrance
GTG-50029: lone French-speaking hacktivist breaches 14 European political entities
In spring 2026 a single actor built a Rust API-key scanner, a WordPress reinstall race-condition exploit and a doxxing platform called fafsearch, gaining internal access to at least 14 of 42 tracked targets.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- France
- Target
- European political parties, media, think tanks, SaaS firms
- Severity
- High
- Triggered by
- GTG-50029 (single French-speaking hacktivist)
- Actor type
- Hacktivist
- Reported loss
- None reported
- CVE
- None
What happened
In spring 2026 a single actor built a Rust API-key scanner, a WordPress reinstall race-condition exploit and a doxxing platform called fafsearch, gaining internal access to at least 14 of 42 tracked targets.
Impact: 12 to 26 GB of database dumps, a campaign platform exposing about 140,000 records including political opinions, and a 15,000-message mailbox.
Who triggered it
Actor: GTG-50029 (single French-speaking hacktivist)
Attribution: Anthropic Threat Intelligence; single French-speaking individual assessed from language and tooling.
Motive: Political hacktivism and doxxing
How it happened
Attack vector: Claude-assisted development of scanners, webshells, a browser-exploitation C2 framework and exploitation of a WordPress reinstallation race condition
Root cause: Exposed API keys and an undocumented WordPress race condition across targets; AI accelerated custom tooling
Timeline
- Campaign against European political entities underway
- Anthropic publishes the case
Response
Anthropic disrupted the activity and shared indicators; victim notifications not detailed.
Current status: Contained
Sources (open in a new tab)
- Anthropic September 2026 threat report anthropic.com
- Unite.AI summary unite.ai
Cite this case
GTG-50029: lone French-speaking hacktivist breaches 14 European political entities. AI Threat Watch, case anthropic-gtg-50029-eu-hacktivist, Sep 10, 2026. https://aithreat.io/cases/anthropic-gtg-50029-eu-hacktivist/
Permanent link: https://aithreat.io/cases/anthropic-gtg-50029-eu-hacktivist/