Claude AI Used to Extract Secrets From 1.8 Million Android Apps

# Claude AI Used to Extract Secrets From 1.8 Million Android Apps Forget the zero-days or state actors, and the real story this week is that attackers stopped doing the hard work. Researchers found criminals using Anthropic's Claude to rip API keys, hardcoded passwords, and private tokens out of almost 2 million Android apps. The tradecraft has changed. Finding secrets in compiled code used to take a mix of tools like grep or strings plus a human who could tell a real AWS key from random junk. Humans were the bottleneck. Now, attackers feed decompiled code into an LLM and automate the analysis part of the attack. They aren't just hunting for patterns anymore. They're asking a machine to find value. I'm pretty sure this is a widespread new tactic, and we've dealt with AI phishing for months, but moving into reverse-engineering is a different beast. I'll be certain once these extracted keys start hitting underground forums in bulk and are linked to LLM scrapers. It reminds me of the mid-2010s when Shodan turned the internet into a searchable directory. You used to scan IP ranges by hand, then suddenly the recon was done for you. We're seeing that again, but for app logic; one difference is that Shodan mapped infrastructure, while LLMs map meaning. Cloud providers are in trouble here, and if a developer leaves an API key in an Android app, they aren't just risking the app. They might be handing over the whole backend. A leaked key doesn't just hurt one user; it hits every customer whose data is in the bucket that key opens. Some people will say developers should just stop hardcoding secrets and call this a failure of basic hygiene. That's an academic argument that ignores how things actually work; in fast deployment cycles, mistakes happen. The problem isn't that developers are sloppy. It's that it now costs the attacker almost nothing to find those mistakes. Then you have Revolut. Talk about a contrast in high-tech narratives. The fintech firm had a breach where passports and Bitcoin records went to criminals; they didn't use an LLM or some fancy zero-day. They used fake government requests. The attackers pretended to be authorities and Revolut just went along with it. I don't think this was phishing; it was a failure of corporate governance. If you handle passports and crypto records, verifying a government request should be an iron wall, not a checkbox, and why is the bar so low? I think we'll see more mid-sized fintechs fall for this "authority fraud" as they grow faster than their compliance teams can keep up. To change my mind, I'd need proof that these requests were sophisticated enough to bypass official channels and multi-factor verification. It's a humbling reminder that you can spend millions on an EDR stack and still be undone by a convincing PDF on a corporate letterhead. Florida is dealing with a cascading failure of identity data. The Florida DMV was hacked soon after IDScan, an identity verification firm, suffered a major breach. This is the core of the crisis. Too much identity data is centralized. When these firms or DMVs get hit, victims are more than just entries on a list. They're people with permanent vulnerabilities. A leaked password takes ten seconds to change. You can't change your date of birth, your social security number, or your driver's license number. With 369 data breach stories this week, the volume is too high for any one person to track which of their permanent identifiers are on the dark web. Then there's synthetic identity fraud, and attackers don't just steal money today. They build Frankenstein identities by mixing a real Florida license number with fake phone numbers and addresses. This lets them open credit lines that stay hidden for years. The numbers tell a clear story, and technology is the biggest target with 294 stories this week. Government follows at 221. The overlap is where it gets dangerous; when a government agency like the DMV uses a partner like IDScan, they aren't spreading out the risk. They're building a single point of failure for millions of people. CISA added five actively exploited flaws to its KEV catalog this week. Artifactory, ScreenConnect and RouterOS are on the list; this is the usual churn of patching. But these tools are all for management and deployment. Attackers aren't just hitting the front door. They're going after the tools admins use to lock it. A ransomware group demanded 8 bitcoins from a hospital in General Santos City. It's small compared to global headlines, but for local patients, it's a catastrophe. Healthcare is the third most targeted sector with 124 stories this week. Despite industry fatigue, these attacks persist because healthcare is a high pressure target. The victims pay because lives are on the line. Why are we still using secret scanning tools that look for known patterns when LLMs can automate secrets extraction from 1.8 million apps in a heartbeat? We're fighting an automated analyst with a static checklist.