Midnight Blizzard uses Claude Code for GTG-20006

According to Anthropic's September 2026 threat report, the threat actor Midnight Blizzard utilized autonomous AI workflows and the Claude Code framework to execute advanced cyberattacks across targets including European governments and defense organizations. The attacks relied on device-code phishing and automated malware rebuilding loops designed to evade endpoint detection. SlashID argues that because recompiling binaries changes hashes but not identity relationships, identity-plane controls like behavioral detection and session revocation are essential for neutralizing such automated threats. Open article →