Reported by 2 outlets

Timeline

1. update from gbhackers.com

   Hackers Turn Claude Code and Codex Into AI-Powered Tools for Credential Theft and Cloud Attacks

   gbhackers.com · 56d ago · August 18th, 2026

   Threat actors are increasingly using coding assistants as operational tools. Detailed research from Gambit Security highlights three campaigns where Claude Code, OpenAI Codex, and large language models facilitated activities ranging from ransomware preparation to the harvesting of secrets on a large scale and exploiting cloud accounts. These cases demonstrate how AI can speed up attackers’ […] The post Hackers Turn Claude Code and Codex Into AI-Powered Tools for Credential Theft and Cloud Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Threat Actors Use Claude Code, Codex and DeepSeek AI to Power Cyberattacks

   cyberpress.org · 56d ago · August 18th, 2026

   A new threat intelligence report from Gambit Security has documented a ransomware affiliate using generative AI as an operational partner throughout a live intrusion campaign, highlighting how AI-assisted attacks are moving far beyond phishing content and basic malware generation. Nir Varon said a suspected affiliate of the Gentlemen ransomware-as-a-service operation used Anthropic’s Claude Code to support nearly every phase of compromise. The activity reportedly included targeting internet-exposed VPN appliances, harvesting credentials, enumerating Active Directory infrastructure, modifying firewall settings, and staging SQL database backups for exfiltration. Threat Actors Use Claude Code, Codex and DeepSeek AI The operator allegedly relied on Claude Sonnet 4.6, a less-restricted model version that may have offered fewer safety controls than newer frontier AI systems. Gambit assessed that the actor compromised at least eight organizations across several sectors, including an Australian energy utility, a Mauritius-based financial-services firm, manufacturing companies in Thailand and the United States, and IT and distribution organizations. Attribution to The Gentlemen RaaS was rated medium confidence. The assessment was based on overlap with the group’s leak site, infrastructure links identified by Hunt.io, and the intruder’s recurring focus on backup systems, an objective commonly associated with ransomware operators seeking to prevent recovery before extortion. Rather than