Anthropic logged agents rebuilding their own malware to beat detection in a Russian-aligned campaign

The loop itself is small, but it is still something defenders have to account for. AI watched whether security products flagged the actor's malware, and when a detection landed, "agents would then set about the process of autonomously modifying and rebuilding the malware to evade the existing detections," according to the report ^[10]. A signature that fires starts a rebuild.

The toolkit behind the handle JackPoterz is conventional in composition: two families of Windows implants, a mobile exploitation kit, a credential stealer aimed at browser password stores, a phishing platform built to imitate priority targets such as government organizations, and an administrative console for managing compromised accounts ^[8]. Anthropic lists the victims as military intelligence bodies inside Ukrainian and European governments, diplomatic and defense organizations, and people connected to U.S. foreign policy ^[9]. The same actor bulk-exported mailboxes at drone component manufacturers, took a complete software development kit for a drone vision system, and spent days reconstructing its architecture and the details of an unannounced product ^[11]. It also compromised hotel Wi-Fi vendors to reach guests through DNS hijacking, took over WhatsApp accounts using headless browsers, and pulled more than 300,000 national identity records from a North African government agency plus registry data on more than half a million companies ^[12].

The criminal case turned on speed. More than 2,100 Azure access tokens across more than 40 corporate tenants, dumped in about 34 hours, works out to roughly 62 tokens an hour sustained ^[15][20].

The student case turned on volume. Two undergraduates at a Chinese university ran vulnerability research around the clock, and one workflow iterating on network appliance firmware "yielded more than a dozen possible zero day findings in a single month," the report said ^[13]. They ran what Anthropic calls agent swarms, a lead agent splitting work among parallel subagents, and kept campaign memory between sessions ^[14]. The report does not say whether any of those findings became a working exploit against a named product.

All of this comes from one vendor reading logs of its own product. Anthropic said it disrupted each operation, strengthened safeguards and shared intelligence with authorities and industry partners where appropriate ^[3]. The Russian link is described as behavior matching Midnight Blizzard. That is not a confirmed identification, and no outside corroboration appears in the report ^[7]. Anthropic also frames these cases as outliers it picked: "The cases we share here aren't typical misuse, but rather examples of the most notable and novel threat activity we've identified to date," the report reads ^[4].

What the report asserts about attribution is the part that changes daily work. "For threat intelligence investigators, sophistication has stopped being a reliable signal of who is behind an operation," it said, noting that a hacktivist working from stolen API keys, scattered criminal affiliates and a state espionage operator each ran campaigns that a year earlier "would have required many skilled operators and specialist knowledge" ^[16][19]. The hacktivist's targets were European political parties ^[18].