Case anthropic-shinyhunters-agentsAI-assisted malwareWorldwide
ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants
Anthropic reported ShinyHunters-linked actors whose AI agents did nearly all the work in a supply-chain breach of 40+ cloud tenants and a three-hour takeover from one stolen token.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Sep 10, 2026
- Location
- Worldwide
- Target
- Corporate cloud tenants
- Severity
- High
- Triggered by
- Suspected ShinyHunters-linked extortion actor
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Anthropic reported ShinyHunters-linked actors whose AI agents did nearly all the work in a supply-chain breach of 40+ cloud tenants and a three-hour takeover from one stolen token.
Impact: More than 2,100 Azure AD token sets tied to 40+ corporate Microsoft tenants compromised; one tenant fully taken over in about three hours from a single token
Who triggered it
Actor: Suspected ShinyHunters-linked extortion actor
Attribution: Assessed by Anthropic as a suspected ShinyHunters threat actor based on tradecraft; not confirmed by law enforcement
Motive: Data theft and extortion
How it happened
Attack vector: Supply-chain compromise of a shared provider, then Claude agents automated extraction of Azure AD authentication tokens and lateral movement from a single stolen token
Root cause: Over-trusted supply-chain access and reusable cloud tokens, with AI agents collapsing the time needed to exploit them
Timeline
- Actor extracts 2,100+ Azure AD tokens across 40+ tenants in about 34 hours; agents do nearly all the work
- Anthropic disrupts the accounts involved
- Anthropic threat report published; Reuters and CyberScoop cover findings
Response
Anthropic banned the accounts, improved detection and shared indicators with authorities and industry
Current status: Contained
Sources (open in a new tab)
- CyberScoop cyberscoop.com
- BleepingComputer bleepingcomputer.com
- Paubox paubox.com
Cite this case
ShinyHunters affiliates use AI agents to dump 2,100+ Azure tokens from 40+ tenants. AI Threat Watch, case anthropic-shinyhunters-agents, Sep 10, 2026. https://aithreat.io/cases/anthropic-shinyhunters-agents/
Permanent link: https://aithreat.io/cases/anthropic-shinyhunters-agents/