Anthropic says a hacker used Claude to run an extortion campaign

Anthropic published a threat report this week describing a financially motivated operator who used Claude across an extortion campaign against at least 17 organizations. The company called the degree of AI use unprecedented.

What Anthropic says happened

The operator used Claude to research targets, help build malware, sort stolen files, pick out what was sensitive, and size bitcoin demands. Victim types included a defense contractor, a financial institution, and healthcare providers. Stolen material, per Anthropic, included Social Security numbers, bank details, medical data, and files tied to U.S. export-controlled defense information.

Demands reportedly ranged from about $75,000 to more than $500,000. Anthropic did not name the victims and did not claim it knew how many paid.

This is still a human crime. Someone chose the targets, held the infrastructure, and sent the notes. The change is how much of the middle of the workflow a model can now absorb: reading dumps, clustering documents, drafting the pressure letter, estimating what the victim might pay.

Why security teams should care anyway

Extortion crews already buy access, exfiltrate file shares, and monetize embarrassment. Adding a capable model does not create a new crime. It changes the staffing math. One operator can do analysis that used to need a small team.

If you are on the victim side, the tell is not “the malware looks like Claude wrote it.” The tell is speed: reconnaissance, sorting, and follow-up messages that arrive faster than a tired human crew usually manages.

If you are on the tool side, this is the misuse case vendors will keep disrupting and attackers will keep wrapping in “I am a penetration tester” prompts.

Where visibility actually helps

The interesting control is not a blog post that says “don’t use AI for crime.” It is noticing when a coding agent or assistant in your environment starts doing the same shape of work: mass file reads, unexpected egress, packaging of archives, drafts that look like ransom notes.

That is agent behavior, not chatbot trivia. If you run tools like Claude Code, you want a record of commands, files, and URLs that is independent of the model’s own account of the session. Ecliptica Replay is built for that trail (local session rebuild and optional rules), which is useful after an odd run even when the operator is one of your own developers, not an extortion affiliate.