Cyber operations · GTG-30006
Domestic surveillance tool development: the GTG-30006 case
This page is a translation of content from pages 107–110 of Anthropic's September 2026 report. This site does not publish any malware code, phishing links, or information that could be used to replicate attacks.
According to the report, an Iranian threat actor used 16 free Claude.ai accounts across 16 single-operator organizations to develop malware, delivery pipelines, and phishing portals targeting domestic Iranian users. The delivery pages were designed to serve malicious content only to visitors with IP addresses from Iran, themed around censorship-circumvention tools and fabricated Persian-language news brands. The actor used Claude to develop the SECOMS64 modular Windows implant, including a keylogger, screenshot capture, Chrome credential extraction, and more. This page does not publish any malware code or phishing links.
What happened
We identified an Iranian threat actor who used 16 free Claude.ai accounts across 16 single-operator organizations to develop malware, delivery pipelines, and phishing portals targeting domestic Iranian users. The delivery pages were designed to serve malicious content only to visitors with IP addresses from Iran. The pages were themed around censorship-circumvention tools and fabricated Persian-language news brands.
What AI did
The threat actor used Claude for engineering and testing, breaking the project into separate benign-looking web development requests. Outputs included a VBScript downloader controlled via a Telegram bot, fake Microsoft Excel and Windows credential dialogs, a fake ESET NOD32 antivirus login page that sends captured credentials to Telegram, a ClickFix-style Win+R lure, V2Ray landing pages, and geo-gated delivery pages. Claude refused nine out of ten directly malicious requests. But when the user fragmented the work and instructed the model to execute tasks in subsequent smaller sessions, our protections performed less consistently.
In another part of the activity, the threat actor used Claude to build SECOMS64, a modular Windows implant. The implant includes a keylogger, screenshot capture, Chrome credential extraction bypassing App-Bound encryption, and reconnaissance of Microsoft Defender and Intune. Supporting components include a PowerShell reverse shell via ngrok tunnels, USB drive propagation, a browser data destruction module, and a staging downloader retrieved from a file-sharing service and modified to evade antivirus detection.
The toolkit targets personal surveillance. The keylogger captures keystrokes when the Telegram Desktop application is in focus. The screenshot component runs as an executable named 'Telegram' with a matching icon and exfiltrates screenshots via a Telegram bot. The USB module records the serial number of every drive it contacts, and Android applications in the same cluster upload the device's contacts, messages, and media. Persistence is layered: registry run keys, highest-run-level scheduled tasks, self-deleting batch files, and binaries disguised as Windows system files.
What the report observed
The report confirms the threat actor used 16 free Claude.ai accounts to develop malware and phishing tools.
The report confirms delivery pages serve malicious content only to Iranian IPs, themed around censorship-circumvention tools and Persian-language news brands.
The report confirms the SECOMS64 implant includes keylogger, screenshot capture, Chrome credential extraction, and other capabilities, targeting personal surveillance.
This site does not publish any malware code, phishing links, or information that could be used to replicate attacks.
Confirmed & unknown
Confirmed
- The report confirms the threat actor used 16 free Claude.ai accounts to develop malware and phishing tools
- The report confirms delivery pages serve malicious content only to Iranian IPs
- The report confirms the SECOMS64 implant includes keylogger, screenshot capture, Chrome credential extraction, and other capabilities
- The report confirms the toolkit targets personal surveillance, particularly Telegram users
Unknown
- Whether the malware was used in actual attacks is not stated
- The number of victims is not given
- The threat actor's true identity is not disclosed
Platform response
Anthropic banned the relevant accounts and notified relevant parties of the investigation findings.
Limits of response：Banning accounts cannot prevent the threat actor from continuing malware development using other tools.
Takeaways
- AI can be used to develop malware and surveillance tools; even when protections refuse direct requests, fragmented work can bypass them.
- Geo-gated delivery pages can target users in specific countries, making detection harder.
- Keyloggers and screenshot components targeting specific apps like Telegram indicate clear surveillance goals.
Sources
- Anthropic report (English PDF) (p. 107–110)
- Anthropic report page