Anthropic’s September 2026 threat report shows how AI lets attackers do more with fewer people. Agents research targets, reconnaissance, build tools, steal data, and modify malware to avoid detection. The techniques remain familiar: stolen credentials, phishing, and unpatched systems. AI reduces the time and manual work needed to use them.
That shift lands hardest on identity. When an agent registers domains, phishes tokens, enrolls rogue devices, and rebuilds malware on a loop, the perimeter and the endpoint each see fragments; the identity plane sees the whole operation. This post examines GTG-20006 in depth and explains where identity controls can interrupt these attacks.
GTG-20006 analysis
Anthropic’s September report links the activity to public reporting on Midnight Blizzard: more than 20 organizations targeted and mail records stolen from at least eight. Operators chose targets and refined Claude Code skills. The group ran customized AI workflows spanning development, infrastructure, phishing, C2, and exfiltration.
| Field | Detail |
|---|---|
| Attribution | Consistent with Midnight Blizzard / SVR; overlaps Storm-2945 |
| Targets | 20+ orgs: Ukrainian/European governments, defense, embassies, drone supply chain |
| Primary access | Device code phishing via the “Embassy Kit” framework, abusing M365 sign-in |
| Toolkit | 2 Windows implant families, mobile exploitation kit, browser credential stealer, phishing platform, admin console |
| Malware | PowerChrome, WUEngine, Shadow C2, MiniPlasma, CloudSyncSvc (Win); GiftDrop (Android); DarkSword (iOS) |
The actor also hijacked DNS on compromised hotel WiFi vendors to intercept travelling diplomats’ traffic, then staged ClickFix lures to drop Windows, Android, and iOS payloads.
AI across the kill chain
Anthropic states the actor used AI at every stage. Humans stayed in the loop only for target selection and to refine the Claude Code skills driving the workflows.
| Stage | What AI did |
|---|---|
| Reconnaissance | Fingerprinted email/remote-access systems, built target lists |
| Initial access | Built and ran the device code phishing platform (Embassy Kit) |
| Persistence | Auto-registered actor-controlled devices into victim tenants |
| Collection | Extracted and organized hundreds of GB of stolen data |
| Evasion | Monitored detections, rebuilt and redeployed flagged malware |
The device code grant is the hinge. It abuses the OAuth 2.0 Device Authorization Grant: the victim completes a real, MFA-backed login on genuine Microsoft pages and simply authorizes the attacker’s waiting session. MFA is not broken — it succeeds for the wrong party. There is no credential form, and no malicious app registration to catch.
SlashID documented how this same flow is now sold as AI-driven phishing-as-a-service in The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave, the basis for our BSides Orlando talk on AI PhaaS reconstruction and device-code phishing.
The malware agentic rebuild loop
Historically, defenders imposed cost: an attacker’s tool ran until a signature caught it, forcing a slow re-tool. GTG-20006 automated that cycle. Monitoring agents watched whether deployed malware was flagged; when it was, agents modified and rebuilt it until it evaded the tested product, then redeployed it to victims for the next wave. The human only chose targets and refined the Claude Code skills.
The following video demonstrates what this would look like: an agent rebuilding itself after being detected by antivirus or EDR tools.
A recompile changes the binary and its hash, but not the identity relationship. The operation still needs a token, a registered device, access to cloud data. That is the surface that does not rebuild away.
The identity path, start to finish
Strip away the malware and the operation is an identity attack. The Embassy Kit framework ran device code phishing at campaign scale; once the victim authorized the waiting session, the actor held access and refresh tokens, automated rogue device registration into the tenant, and bulk-exported mailboxes over Graph.
Domains published by Anthropic (ms365-live[.]com, m365-owa[.]com, owa-ms365[.]com) and IP 31.57.243[.]154 also appear in Microsoft’s CaptiveCrunch indicators as M365 device-code and AiTM infrastructure, the same impersonation-of-Microsoft-sign-in pattern behind the token theft.
Where to interrupt the identity chain
Every stage the agent automated leaves an identity signal that a recompile cannot erase. Microsoft recommends blocking device-code flow wherever possible.
SlashID helps by:
| GTG-20006 action | Identity signal | SlashID control |
|---|---|---|
| Device code phishing (Embassy Kit) | Device-code grant; token from anomalous ASN/geo | ITDR – behavioral detection on the device-code sign-in |
| Rogue device registration | New device tied to a fresh token | Detection on the registration / PRT persistence pivot |
| Bulk mailbox export | High-volume Graph read fan-out | NHI/behavioral detection on the recon burst and export velocity |
| Permissive defaults | Unrestricted device-code flow, open consent | ISPM flags the posture gap; graph inventories OAuth apps and NHIs |
| Agentic tooling using stolen tokens | Non-human identity acting outside baseline | AI access control: authorize each MCP/tool call against the identity behind it |
Static indicators and endpoint signatures still matter, but they decay at machine speed against an actor who rebuilds on a loop.
The parts that do not rebuild away — obtaining trusted identity, minting a token, registering a device, reading cloud data — are exactly what identity telemetry makes visible and revocable. Because a password reset leaves a refresh token alive, response must revoke the grant, tokens, and PRT and kill the session, which is where SlashID’s automated remediation closes the loop.
Would you see the identity trail before the next rebuild?
GTG-20006 recompiled its malware every time it got caught, but it never rebuilt the device-code grant, the rogue device or the Graph export burst behind it. SlashID detects that sequence across your tenant and revokes the grant, tokens and PRT before the mailboxes leave.
References
[1] Anthropic, “Detecting and countering misuse of AI: September 2026.” https://www.anthropic.com/threat-intelligence-report-september-2026
[2] Microsoft, “CaptiveCrunch: Midnight Blizzard targets travelers.” https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
[3] Hive Security, “When malware rebuilds itself.” https://hivesecurity.gitlab.io/blog/gtg-20006-ai-malware-rebuild-detection/
[4] SlashID, “The Illicit Consent Grant Part 2: Device-Code Phishing and the AI PhaaS Wave.” https://slashid.com/blog/illicit-consent-grant-part-2
[5] AIMaL – Artificially Intelligent Malware Launcher. https://github.com/EndritShaqiri/AIMaL
