Threat actors are leveraging artificial intelligence to orchestrate coordinated cyberattacks that operate with minimal human oversight, automating everything from credential harvesting to data theft across dozens of organizations at once. Two major security disclosures reveal how attackers are weaponizing AI models and social engineering to compromise cloud environments and execute financial fraud at unprecedented scale.

What's Happening: AI-Powered Attacks Go Autonomous

Anthropic, the company behind the Claude AI model, has documented a troubling trend over the past nine months. Between December 2025 and August 2026, the company identified multiple groups of cybercriminals and state-sponsored hackers using Claude to automate cyberattacks. What makes this different from traditional hacking is the level of automation involved. Rather than having humans manually execute each step of an attack, these threat actors are using AI to run multi-agent frameworks that conduct reconnaissance, exploitation, and data theft with minimal human input, sometimes operating autonomously for hours or days.

One particularly striking example involves a French-speaking operator tracked as GTG-50014, who used Claude to orchestrate a distributed credential-harvesting operation across a fleet of 10 Amazon Web Services (AWS) EC2 workers. This automated pipeline mass-downloaded 1.8 million distinct Android applications from multiple app stores, scanned them for hard-coded secrets using a tool called TruffleHog, and sent verified findings to a Telegram group for sale. The entire operation ran with minimal human oversight.

Meanwhile, Microsoft has disclosed a separate campaign in which attackers are using passkey-themed social engineering to hijack cloud accounts and exfiltrate sensitive data. The activity, detected since May 2026, follows a pattern where threat actors call employees posing as IT help desk staff, urging them to update their passkey or multi-factor authentication (MFA) settings. Unsuspecting employees are redirected to counterfeit websites that mimic legitimate Microsoft sign-in pages, allowing attackers to capture credentials or grant themselves access through adversary-in-the-middle (AitM) attacks.

How Are Attackers Using AI to Scale Their Operations?

The integration of AI into cyberattacks has fundamentally changed the economics of hacking. Anthropic noted that "the cybersecurity skills of AI models means that AI has collapsed the labor and tooling gap that used to separate well-resourced, state-sponsored operations from individual operators". In other words, a single person with access to an AI model can now accomplish what previously required a team of skilled engineers.

Anthropic

The threat actors documented by Anthropic span a wide spectrum of sophistication and motivation. Some use Claude conversationally, asking it to help write malware, phishing kits, and surveillance tools. Others direct Claude to execute operations directly, such as running commands against victim networks and harvesting credentials, with humans making targeting decisions. At the far end of the spectrum, operations run almost entirely autonomously, with AI systems making decisions about which targets to attack and how to extract data.

One Russian state-sponsored group, tracked as GTG-20006 and sharing overlaps with the advanced persistent threat (APT) group known as Midnight Blizzard, developed an AI-assisted workflow that automated reconnaissance and exploitation. A Chinese-speaking operator group, GTG-10007, used Claude to conduct intrusion attempts against production systems, reconnaissance of foreign government networks across the Middle East, Europe, and Southeast Asia, and vulnerability research against major endpoint-security products. The group targeted approximately 50 organizations across education, retail, energy, technology, healthcare, finance, manufacturing, and government sectors globally.

The Financial Fraud Angle: Generative AI Meets Social Engineering

Beyond cloud breaches, attackers are using generative AI to craft highly convincing financial fraud schemes. Microsoft disclosed a campaign in which threat actors sent over one million scam emails between August 3 and 5, 2026, impersonating chief executive officers (CEOs) of target companies. The emails requested Automated Clearing House (ACH) transfers for supposed ServiceNow annual subscriptions.

What made these emails particularly effective was their sophistication. Attackers used generative AI to create email templates and draft messages tailored to specific recipients. They registered impersonation domains, embedded fabricated invoices and supporting email conversations, and even plugged the names and email addresses of actual CEOs, CFOs, and presidents into the email signatures to lend credibility. The campaign primarily targeted enterprise users in the United States across IT services, consumer goods, real estate, and discrete manufacturing sectors.

"Unlike traditional invoice scams that rely on a single social engineering lure, this campaign layered executive impersonation, vendor branding, fabricated invoices, and supporting email conversations into a unified narrative intended to reduce recipient skepticism," Microsoft Security Research team stated.

Microsoft Security Research Team

How to Protect Your Organization From AI-Powered Attacks

• Implement Robust MFA Beyond Passwords: Move beyond simple password-based authentication. Use hardware security keys or authenticator apps that cannot be phished through AitM attacks. Monitor for suspicious MFA enrollment attempts, particularly new phone numbers or authenticator applications registrations from unfamiliar devices.
• Conduct Employee Security Training on Passkey and SSO Lures: Train staff to recognize that legitimate IT help desk personnel will never ask them to update authentication credentials via unsolicited phone calls or text messages. Teach employees to verify requests by contacting IT through official channels rather than clicking links in messages.
• Monitor Cloud Account Activity for Anomalies: Watch for unusual sign-ins from unmanaged devices, unexpected Graph API activity, high-volume SharePoint and OneDrive downloads, and mailbox collection through REST APIs. These patterns often indicate a compromised account being used for reconnaissance and data exfiltration.
• Verify Financial Requests Through Out-of-Band Communication: Implement a policy requiring all payment requests, especially large ACH transfers, to be verified through a separate communication channel. Call the supposed requester directly using a known phone number rather than relying on email addresses provided in the request.
• Audit Third-Party Email Infrastructure: Review which external services have permission to send emails on behalf of your organization. Attackers are abusing trusted email delivery infrastructure to bypass spam filters and make phishing emails appear more legitimate.

Who Are These Threat Actors, and What Do They Want?

The groups using AI for attacks are diverse in motivation and capability. Anthropic identified state-sponsored groups, financially motivated criminals, commercial spyware vendors, state propaganda institutions, and politically motivated individuals all leveraging Claude for malicious purposes. Some groups, like GTG-50021, have even created fraudulent AI reseller operations, offering cheap Claude access while secretly proxying traffic to different AI models and harvesting customer credentials for sale to other attackers.

Others are focused on stealing from the AI supply chain itself. GTG-50020, a Russian-speaking financially motivated actor, has targeted approximately 30 AI vendors in a four-day window, attempting to steal model provider API keys and gain access to pre-release AI models. This suggests that as AI becomes more valuable, attackers are increasingly targeting the infrastructure and intellectual property behind these systems.

The passkey phishing campaign documented by Microsoft appears to be connected to a loose-knit cybercrime collective operating under multiple names, including Cordial Spider, O-UNC-045, PREY-0058, and UNC6671. Microsoft attributes the initial access activity to threat actors including Storm-3121 and Storm-3032, with connections to extortion groups like ShinyHunters, Falcon, and Helix.

Why This Matters Now

The convergence of AI capabilities and social engineering represents a fundamental shift in the threat landscape. Attackers no longer need to be highly skilled engineers to execute sophisticated cyberattacks. They can use AI models to automate reconnaissance, write convincing phishing emails, develop exploits, and orchestrate multi-stage attacks across dozens of victims simultaneously. The barrier to entry for cybercrime has dropped dramatically, while the scale and speed of attacks have increased exponentially.

Organizations that rely solely on traditional security measures, such as password-based authentication and email filtering, are increasingly vulnerable. The attacks documented by Microsoft and Anthropic demonstrate that threat actors are investing heavily in pre-attack research, gathering information about employees and organizational structures from public sources like social media and professional networking platforms, then using AI to craft highly personalized and convincing attacks.

The security community is still grappling with how to defend against these AI-augmented threats. What is clear is that the old playbook of relying on user awareness and basic technical controls is no longer sufficient. Organizations need to implement layered defenses that account for the sophistication and scale of AI-powered attacks.