Security software often recognizes malware by its fingerprints. These fingerprints can include parts of the file, its code, or the way it behaves.
Now imagine malware that is detected, changed, rebuilt, and tested again. An attacker would once have needed to repeat much of that work by hand. Anthropic says it found an espionage operator using AI workflows to help run this loop automatically.
This does not mean the malware was thinking for itself. A person still chose the targets and the goal. The AI helped carry out repetitive technical work faster.
What Anthropic reported
Anthropic tracks the operator as GTG-20006. It says the activity matches public reporting about a Russian state-linked group commonly called Midnight Blizzard.
According to Anthropic’s September 2026 threat report, the operator used custom AI workflows across several parts of its attacks. These included creating attack infrastructure, running phishing campaigns, keeping access to compromised systems, and collecting stolen data.
One use stands out. AI agents watched whether security products detected the operator’s malware. When a tool was detected, the agents changed and rebuilt it. The process continued until the new version was no longer detected by the security checks being monitored. The rebuilt tools were then placed on temporary hosting servers for use in attacks.
Anthropic says the operator’s planning and live activity involved more than 20 organizations. The targets included government, diplomatic, defence, intelligence, and defence-supply organizations. Most were in Ukraine and Europe, with some targeting connected to the Middle East and Asia.
How the evasion loop works
1. Security software detects a malicious tool.
2. An AI workflow changes the tool and rebuilds it.
3. The attacker tests or stages the new version.
4. The cycle repeats if the new version is detected.
This is called detection evasion. It means changing an attack so security tools have a harder time recognizing or stopping it.
What is confirmed, and what is not
Anthropic says it observed the activity through the use of its own AI service. It banned related accounts and added safeguards.
The public report does not provide every log, malware sample, victim name, or technical measurement needed for outsiders to reproduce the full investigation. The claims should therefore be described as Anthropic’s findings, not as an independently verified public forensic record.
The report also does not show that AI selected the victims on its own. Anthropic says people remained involved in the decisions that mattered most, including choosing targets and reviewing results. AI increased speed and automation; it did not remove the attacker.
Why businesses should care
Many security tools can block known malicious files. That still helps, but a file fingerprint may become less useful when an attacker can create new versions quickly.
Defenders need to look at behavior as well as file identity. Suspicious behavior can include a program stealing browser passwords, creating unusual login sessions, contacting an unfamiliar server, or returning after it was removed.
AI also lowers the effort needed to run several attack tasks at once. A smaller team may be able to send phishing messages, manage attack servers, change malware, and watch compromised systems in parallel.
Four practical actions
1. Watch behavior, not only file names. Make sure endpoint and cloud monitoring can alert on credential theft, unusual processes, unexpected persistence, and suspicious outbound connections.
2. Contain suspicious devices quickly. Give the security team a tested way to isolate an affected computer, disable stolen sessions, and reset exposed credentials.
3. Make stolen passwords less useful. Use phishing-resistant multifactor authentication where possible, limit administrator access, and remove permissions people or applications do not need.
4. Test recovery. Keep protected backups and practise restoring essential systems. An attacker should not be able to delete production data and its recovery copy with the same account.
The useful lesson is not that every piece of malware now has an AI brain. It is that attackers can automate the work between detection and the next attempt. Businesses need several layers of defence so one changed file does not defeat the whole security plan.
How EDR, XDR and MDR Help Defend Against AI-Powered Malware
As cybercriminals increasingly use artificial intelligence to modify malicious code and automate attack workflows, organizations need security solutions that go beyond traditional file-signature detection.
Endpoint Detection and Response (EDR) continuously monitors endpoint activity to identify suspicious processes, unauthorized system changes, credential theft attempts, and malicious execution patterns.
Extended Detection and Response (XDR) correlates security information across endpoints, networks, identities, email, and cloud environments. This broader visibility helps security teams identify related malicious activities even when attackers modify their malware.
Managed Detection and Response (MDR) provides continuous security monitoring, threat investigation, and incident response support to help organizations detect and contain threats before they escalate.
Organizations should combine these capabilities with strong identity security, network protection, vulnerability management, and tested backup and recovery procedures.
AZAS Technologies helps businesses in the UAE strengthen their cybersecurity posture through advanced security solutions, vulnerability assessments, and layered threat protection strategies.
Protect Your Business Against Evolving Cyber Threats
AI-driven threats are changing how attackers operate. AZAS Technologies helps organizations strengthen cybersecurity through advanced endpoint protection, XDR/MDR, vulnerability assessments, and security monitoring.
Organizations reviewing those layers can also see AZAS Technologies’ cybersecurity services.
## Sources and date notes
– Anthropic, “Detecting and countering misuse of AI: September 2026,” September 10, 2026. Primary disclosure for GTG-20006 and the AI-assisted rebuilding workflow. The report covers cases observed from December 2025 through August 2026.
– Microsoft Digital Defense Report 2026. Supporting source for layered identity protection, phishing-resistant authentication, and behavior across human and non-human identities.
*Editorial note: This article is based on public reporting. AZAS Technologies did not investigate the operation.*
