You Didn't Do Anything Wrong — But Your Account Was Used to Attack Political Organisations

Executive Summary

Kariba Security Group is issuing this advisory about a threat that is particularly alarming for small businesses: having your AI account used to conduct attacks against political parties, media organisations, and civil society groups — without your knowledge or involvement.

Anthropic's September 2026 threat intelligence report documents a hacktivist campaign (GTG-50029) in which a single actor built a custom tool to scan public sources for exposed API keys, validated the stolen keys, and then used those keys as the computing infrastructure for their attacks. The actor ran their entire month-long campaign on stolen API keys. Your business did nothing wrong and had no connection to the targets — but if your key was stolen, your account became the platform for attacks against organisations you've never heard of.

Why This Matters Beyond the Obvious

The immediate concern is account suspension and unexpected charges — both serious for a small business. But the less obvious risks are significant:

Your account appears in the attacker's activity log

Law enforcement investigations into hacktivist campaigns follow the digital trail. That trail may lead to your API account before investigators determine it was compromised — not controlled by you. This creates a period of unwanted scrutiny that can be disruptive and distressing even when you're cleared quickly.

Account suspension disrupting your operations

If your account is flagged for misuse, you may lose access to AI services your business depends on. For a business that has built AI into its daily workflow, losing that access without warning can halt operations for days or weeks while the account is investigated and restored.

Reputational questions

If your credentials are used in a politically motivated attack and that association becomes public before the compromise is established, the reputational impact can be significant — particularly for businesses that serve clients who would be sensitive to that association.

How the Campaign Worked

The GTG-50029 actor built an automated pipeline that:

1. Continuously scanned public sources — GitHub repositories, paste sites, app binaries — for exposed API keys
2. Validated each discovered key to confirm it was active and determine its access level
3. Deployed valid keys as rotating compute resources for the attack campaign
4. Cycled through keys as they were suspended or revoked, moving to the next available one

The actor was able to sustain a month-long campaign without using their own infrastructure or incurring costs, because the stolen keys provided effectively unlimited compute funded by the victims.

Immediate Actions if You Suspect Your Key Was Used This Way

1. Revoke the compromised key immediately and create a new one following secure storage practices
2. Review your usage logs for the period in question — document everything you find, particularly API calls with patterns inconsistent with your normal usage
3. Contact Anthropic support through support.anthropic.com and report what you have found. Anthropic's threat intelligence team actively investigates this category of abuse, and information you provide may help them understand and disrupt the operation
4. Preserve records — do not delete logs or account history. If you're contacted by law enforcement, having clear records of when your key was compromised and what usage occurred is essential
5. Consult a lawyer before making public statements about the incident

Prevention

The prevention measures for this threat are the same as for direct credential theft — because the initial compromise mechanism is identical. The GTG-50029 actor targeted keys that were already exposed in public sources. Keeping your keys out of those sources eliminates your exposure to this specific threat.

• Never hardcode API keys in source code, configuration files, or mobile app binaries
• Use environment variables and a secrets manager to store keys
• Audit your repository history for any previously exposed keys and revoke them
• Set usage alerts so anomalous activity is flagged before significant charges accrue
• Rotate keys every 90 days as standard practice