Anthropic just published its September 2026 Threat Intelligence report, a review of malicious Claude events that they detected and disrupted between December 2025 and August 2026.
Most of their findings are about cyber espionage and state-actor operations, which we won’t cover here. But a few of the case studies do offer a look at some noteworthy fraud tactics that are being driven by AI. These stories are important for fraud and risk teams to be aware of, as you seek to defend against these ever-emerging risk patterns and threat vectors.
Here are some of the main highlights that we found. Let’s dig in.
1. Account farming and credential theft at AI-factory scale
GTG-50020 is the case of a Russian-speaking fraudster who had conducted intrusions against hotel booking and fintech platforms. The actor then pivoted and tried their same tactics against the AI industry itself, using prompt injection against an AI vendor's automated evaluation sandbox to steal production API keys from multiple providers.
The report describes their "fraud account factory" pattern:
- Residential proxies and antidetect browser profiles were provisioned, after which bots drove signup flows on exchange and marketplace targets
- Commercial CAPTCHA-solving services, automated inbox polling, and automated identity-verification steps all were used to defeat onboarding controls
- Credential theft: Worker agents ran injection, XSS, authentication-bypass, and SSRF testing without human supervision, collecting potential findings and credentials into the actor’s workspace
This is multi-accounting and account farming, run at a fully automated scale. Every stage of which is specifically designed to look like a distinct, legitimate device and user.
2. KYC completion is being intercepted, not just spoofed
A companion pattern employed by the same fraudster was the "KYC interception cloak."
This tactic routed victims to lookalike verification domains that reverse-proxied the real KYC flow. The victim completed genuine identity verification while the fraudster's proxy captured their verified session and documents, then reused that already-verified session from the attacker's own machine.
The identity data is real. What's fraudulent is the device and session presenting it. A verified identity showing up on a device and in a context it never actually touched: This is the exact gap and fraud signal that device intelligence can catch.
> You can read our detailed report on how to eliminate blind spots in identity verification here.
3. Fraudsters are engineering around similarity checks
GTG-15001 is a case where a China-based app studio used Claude to first build a network of over 20 dating apps, then power them with a network of AI personas who would converse with human users.
The app ran as a three-side marketplace: scamming real users, employing gig workers who were incentivized to participate in live video calls and social media follows (which were deployed to decrease skepticism by the scam’s victims), and running Claude-driven personas, which operated autonomously to simulate legitimate activity.
But on the app-build level, each of the 20 app variants had deliberately differentiated class names, specifically to defeat the similarity checks platforms use to link related apps.
It's the same evasion logic threat actors attempt to apply against device fingerprinting: Vary just enough of the client-side signature to avoid clustering, while reusing the same backend infrastructure underneath.
4. Apps are being built to behave differently in different contexts
The same app studio case included dev docs for a UI controller that would activate only during App Store and Play Store review and was otherwise dormant. In short, the app behaved one way for reviewers and another way for real users.
They also built a server-side-configurable in-app browser that could silently reroute payments to third-party processors, outside the platform's own payment rails—and toggle that behavior off so it could be hidden during review.
This is another form of payment fraud that device intelligence exists to counter more broadly: Bad actors building around monitoring or scrutiny checks, and suppressing malicious behavior only in front of it.
5. The "card-fraud supply chain" is open for business
The report describes cases of suspected cybercrime by the ShinyHunters collective, known for several large-scale data theft operations followed by pay-or-leak extortion demands.
In one case, they ran a carding storefront (autoshop.policenationale[.]cc) selling stolen payment-card records enriched with BIN lookups, full cardholder PII, and an interactive map of victim addresses. This was delivered to buyers through a Telegram Mini App backed by a searchable PostgreSQL/GraphQL platform.
It's a reminder that the card-fraud supply chain (theft, enrichment, resale) is being rebuilt with the same AI-assisted tooling as everything else in this report, making stolen card data more usable, more searchable, and faster to monetize.
Combine that with the dating-app case's payment-redirection scheme and you get two different but related payment-fraud vectors.
Easy-to-access stolen card data is flowing into checkout flows, making those transactions harder to distinguish from legitimate ones. And legitimate-looking apps are being constructed to silently move transactions off the platforms that have built-in fraud and chargeback protections.
6. Sophisticated attacks no longer require sophisticated attackers
The diffusion of AI has leveled the playing field. Whether it’s small-scale criminal groups or state-sponsored actors, both classes have access to the same set of advanced capabilities.
The main distinguishing factor is no longer sophistication but intent. The attacks described are familiar, whether they involve stolen credentials, unpatched edge devices, exposed services, SQL injection, and phishing.
What AI has done is compress fraud tactics into repeatable, engineered workflows that a single operator can run at a scale that used to require a staffed team: One actor's "fraud account factory," one studio's twenty-variant dating-app network, one cluster's carding storefront.
It’s clear that as more actors continue to adopt AI frameworks, there’s only going to be more fraud attacks at greater speed and scale.
The one common thread: None of these attacks are new
Across the account takeover, multi-accounting, and payment fraud patterns in this report, the attacks aren't defeating identity, credential, or payment checks head-on. They're defeating the assumption that a credential, a verified session, or a card number reliably maps to one real device and one real person.
That's exactly why device signals matter more now, not less. Identifying and distinguishing bot activity, VM and antidetect browser use, VPN use, location anomalies, and browser tampering—and assembling those signals into a live risk assessment—can be a vital way to catch what identity and payment checks alone can't.
By combining persistent device identification with real-time signals that reveal automation, browser tampering, and other risk indicators, Fingerprint helps businesses detect the suspicious activity and threat patterns being driven by AI. And with our bot detection and AI agent detection capabilities, fraud and risk teams can distinguish between automated traffic types to prevent impersonation and more types of AI-powered fraud.
> For a closer look at how Fingerprint device intelligence works, you can start a free trial or contact our sales team.
