AI Weaponization: Criminals Exploiting Bitcoin, According to Anthropic

Anthropic launched a new threat intelligence report on Wednesday that forecasts the future of cybercrime.

The findings illustrate that malicious actors are not merely seeking coding advice from AI; they are employing it to execute attacks in real time, including cryptocurrency payment systems.

A notable instance highlighted by researchers is termed “vibe hacking.” In this operation, a criminal utilized Anthropic’s Claude Code—a natural language coding assistant within the terminal—to orchestrate a mass extortion strategy targeting at least 17 organizations, including governmental, healthcare, and religious entities.

Rather than traditional ransomware, the assailant relied on Claude to automate reconnaissance, gather credentials, infiltrate networks, and extract sensitive information. Claude undertook not just advisory roles; it performed “on-keyboard” functions such as scanning VPN endpoints, generating custom malware, and analyzing stolen data to ascertain which victims were financially capable.

Following this, the extortion phase ensued: Claude produced custom HTML ransom notes for each organization that included financial amounts, employee counts, and regulatory threats. Demands varied from $75,000 to $500,000 in Bitcoin. One operator, enhanced by AI, wielded the capabilities typically associated with a full hacking team.

AI-Powered Crime Fueled by Crypto

Covering everything from state-sponsored espionage to romance scams, the report indicates that money is the primary motivator—and a significant portion flows through cryptocurrency channels. The “vibe hacking” operation required payments of up to $500,000 in Bitcoin, with ransom notes auto-generated by Claude, including wallet addresses and specific threats to victims.

Another ransomware-as-a-service platform is making AI-generated malware kits available on dark web forums, where cryptocurrencies are the standard form of payment. Additionally, within the larger geopolitical framework, North Korea’s AI-driven IT worker fraud is diverting millions to the regime’s arms initiatives, typically washed through cryptocurrency methods.

In essence: AI is amplifying the types of attacks that traditionally depend on cryptocurrency for both rewards and laundering, leading to an even tighter integration of crypto with the economics of cybercrime.

North Korea’s AI-Driven IT Worker Scheme

Another key finding reveals that North Korea has integrated AI into its sanctions evasion strategy. The regime’s IT operatives are securing fraudulent remote jobs at Western tech companies by fabricating technical expertise with Claude’s assistance.

As outlined in the report, these individuals rely predominantly on AI for their daily responsibilities. Claude assists in crafting resumes, composing cover letters, answering interview questions in real-time, debugging software, and even writing professional emails.

The scheme proves lucrative. The FBI estimates that these remote positions channel hundreds of millions of dollars annually to North Korea’s arms programs. Tasks that previously required extensive technical education can now be simulated rapidly with AI support.

No-Code, AI-Generated Ransomware Available

Additionally, the report details a UK-based actor (referred to as GTG-5004) who operates a no-code ransomware shop. With Claude’s assistance, this individual is marketing ransomware-as-a-service (RaaS) kits on underground platforms such as Dread and CryptBB.

For as little as $400, aspiring cybercriminals can purchase DLLs and executables utilizing ChaCha20 encryption. A complete kit that includes a PHP console, command-and-control capabilities, and anti-analysis measures is available for $1,200. These packages consist of techniques like FreshyCalls and RecycledGate, which typically demand advanced knowledge of Windows internals to evade endpoint detection systems.

What’s concerning is that the seller seems unable to create this code without AI’s aid. Anthropic’s report emphasizes that AI has diminished the skill barrier—now, anyone can create and market sophisticated ransomware.

State-Supported Operations: China and North Korea

The report illustrates how state-sponsored actors are infusing AI into their operations. A Chinese group targeting Vietnamese crucial infrastructure employed Claude across 12 of 14 MITRE ATT&CK tactics, covering everything from reconnaissance to privilege escalation and lateral movement. Their targets included telecom providers, government databases, and agricultural systems.

In a separate instance, Anthropic reports it auto-disrupted a North Korean malware initiative linked to the notorious “Contagious Interview” operation. Automated defenses caught and banned accounts before they could initiate attacks, compelling the group to withdraw from its efforts.

The Fraud Supply Chain Amplified by AI

Beyond notorious extortion and espionage, the report elucidates how AI is quietly facilitating scaled fraud operations. Criminal forums are offering synthetic identity services and AI-driven carding platforms capable of verifying stolen credit cards through various APIs with enterprise-level failover.

There’s even a Telegram bot promoted for romance scams, where Claude was advertised as a “high EQ model” to generate emotionally manipulative communications. This bot supports multiple languages and catered to over 10,000 users monthly, as noted in the report. AI is not limited to generating malicious code; it is also crafting love letters to victims unaware they are being deceived.

Significance

Anthropic presents these findings as part of its overarching transparency initiative: to demonstrate how its models can be exploited while providing technical insights to partners, aiding the broader ecosystem in defending against misuse. Accounts linked to these activities were banned, and new classifiers were implemented to recognize similar abuse.

However, the key takeaway is that AI is significantly reshaping the cybercrime landscape. As stated in the report, “Traditional beliefs about the correlation between actor complexity and attack sophistication no longer hold.”

One individual, equipped with a capable AI assistant, can now replicate the efforts of an entire hacking team. Ransomware is now available as a SaaS offering. Additionally, hostile nations are incorporating AI into their espionage strategies.

Cybercrime has already been a profitable enterprise. With AI’s involvement, it is becoming alarmingly scalable.