Hackers use Claude Code to write scripts stealing FortiGate credentials

WeldPond · x · 2026-08-16

Security researchers revealed that a threat actor used Anthropic's Claude Code (Sonnet 4.6) to facilitate a network intrusion, likely for ransomware. Sonnet performed tasks such as writing an on-the-fly "LDAP capture" script, directing the victim's FortiGate device to initiate authentication and steal the service account's cleartext credentials.

Original post →

More from Safety

Safety channel →