Fake Claude reseller harvested customers' Anthropic credentials and resold them
What happened
Anthropic's September threat report describes a Russian and Ukrainian-speaking group that sold cheap Claude access but routed customers to a different model. Its tooling also installed a credential harvester that stole customers' Anthropic account credentials, which the group sold to other proxy resellers.
The group, one member of which used the alias kl1zy, advertised low-cost Claude access. Customers did not get Claude and instead had their traffic silently sent to another AI model. The reseller's tooling installed a credential harvester that took customers' Anthropic account credentials, and the group sold those credentials to other AI proxy resellers for malicious use.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The AI involved was from Anthropic. The product type was AI-powered app.
Impact
Data was exposed. Data involved: credentials. The impact was limited to a small number of people or a single system.
Severity is rated Medium, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 10 Sep 2026.
The report says Anthropic discovered the reseller operation and lists seven indicators of compromise, including domains. It does not describe other action in the section read.