Poison Claude-Ecomagent.in alliance reshapes ransomware ecosystem operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
Poison Claude and similar gray-market services are expanding an underground market for discounted frontier AI access, raising prompt visibility, privacy, and abuse risk for customers. Operators route requests through pooled accounts and charge a fraction of official token prices, often using AWS Bedrock bonus credits to subsidize access. The services also mask infrastructure behind Cloudflare and accept cryptocurrency. Researchers observed the ecosystem across underground cybercrime forums and messaging platforms.
Related Happenings
Obsidian Security raises $85 million Series D
Commercial Activity
H score19
First: 04.08.2026 15:00
Last: 04.08.2026 15:00
Sources 1
About this happening:
Obsidian Security raised $85 million in a Series D at a $1.1 billion valuation, adding capital to expand its agentic AI security business. The round lifts tota...
Obsidian Security raises $85 million Series D
Commercial ActivityAbout this happening: Obsidian Security raised $85 million in a Series D at a $1.1 billion valuation, adding capital to expand its agentic AI security business. The round lifts tota...
Vo1d botnet campaign targeting unofficial Android-based TV boxes
Campaign
H score88
First: 18.06.2026 20:37
Last: 18.06.2026 20:37
Sources 1
About this happening:
NetNut used the Popa botnet and deceptive SDKs on off-brand Android-based smart TVs, streaming media boxes, and unofficial apps to turn home connections into residen...
Vo1d botnet campaign targeting unofficial Android-based TV boxes
CampaignAbout this happening: NetNut used the Popa botnet and deceptive SDKs on off-brand Android-based smart TVs, streaming media boxes, and unofficial apps to turn home connections into residen...
Latest development: 03.07.2026 12:35
Google disabled all Google accounts used by NetNut for malware command-and-control, updated Google Play Protect to warn Android users, and disabled apps containing the compromised SDKs. The FBI’s seizure banner appeared on netnut.com while netnut.io briefly remained accessible, and Google said the coordinated actions caused significant degradation to NetNut’s proxy network and business operations.
Willow raises $7M seed round for AI agent IAM platform
Industry Action
H score10
First: 04.06.2026 17:22
Last: 04.06.2026 17:22
Sources 1
About this happening:
Willow emerged from stealth with $7 million in seed funding, giving the startup new capital to scale an identity and access platform for enterprise AI agents. The comp...
Willow raises $7M seed round for AI agent IAM platform
Industry ActionAbout this happening: Willow emerged from stealth with $7 million in seed funding, giving the startup new capital to scale an identity and access platform for enterprise AI agents. The comp...
Widespread exposure and misconfiguration in self-hosted AI infrastructure
Trend
H score76
First: 05.05.2026 13:30
Last: 05.05.2026 13:30
Sources 1
About this happening:
A large-scale measurement found self-hosted AI infrastructure was being deployed with widespread exposure and no authentication, creating a broad risk of data theft, workf...
Widespread exposure and misconfiguration in self-hosted AI infrastructure
TrendAbout this happening: A large-scale measurement found self-hosted AI infrastructure was being deployed with widespread exposure and no authentication, creating a broad risk of data theft, workf...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor Meta
H score43
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor MetaAbout this happening: Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Timeline
-
05.08.2026 18:36 2 articles · 3h ago
Poison Claude and Ecomagent.in sell discounted access to Anthropic models
Initial DisclosureResearchers identified Poison Claude and Ecomagent.in advertising discounted access to Anthropic's LLMs through Anthropic-compatible proxy APIs that route prompts through pooled accounts funded with AWS Bedrock bonus credits. Customers pay in cryptocurrencies, receive an API key, and can point Claude Code at the broker so the operator sees forwarded prompts; the exposed api.claudeopus[.]shop/api/status endpoint returned 881 total users and 872 active users before it was fixed.
Show sources
- Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt — thehackernews.com — 05.08.2026 18:36
- Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt — thehackernews.com — 05.08.2026 18:36