Ledger / 10 Sep 2026
Fraudulent cheap-Claude reseller harvests Anthropic credentials
Confirmed
Anthropic investigated and lists indicators of compromise.
A Russian and Ukrainian-speaking group sold fake discounted Claude access that was neither cheap nor Claude. Stolen credentials were sold on to other AI proxy resellers.
“They ran a fraudulent AI reseller operation offering cheap Claude access”Anthropic
Sources
- Detecting and countering misuse of AI: September 2026Anthropic · 10 Sep 2026 · primary source
- Disclosed
- 10 Sep 2026
- Activity
- 2026
- Actor
- GTG-50021 (alias kl1zy) (criminal), as attributed by Anthropic
- Targets
- Customers seeking discounted Claude access
- What the AI did
- Fraud, LLMjacking
- Model
- Claude (impersonated), unspecified substitute model
- Model family
- Anthropic, Unspecified
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Traffic silently proxied to another model while a harvester stole Anthropic account credentials for resale.