ai-security

How Did Iran Use Free AI to Launch Cyberattacks?

Anthropic's September 2026 threat report describes an Iranian operator who used 16 free Claude.ai accounts to build malware, a delivery pipeline and a Farsi phishing portal that only infected visitors with Iranian IP addresses. No budget, no team, no elite hacking skills. The same recipe works anywh

Lucas Oriens Kim

12 9월 2026 • 8 min read

Quick Answer
In its September 2026 threat intelligence report, Anthropic described an Iranian threat actor running 16 separate single-operator accounts on the free tier of Claude.ai to build malware, a delivery pipeline, and a Farsi-language phishing portal aimed at Iranians. The pages only served the malicious payload to visitors with Iranian IP addresses, and they were dressed up as censorship-circumvention tools and a fake news brand. Cost of the tooling: zero. That is the part that should worry you.

Sixteen Free Accounts, One Operator, One Country

16 free-tier accounts

Read the Anthropic write-up carefully and a strange detail jumps out. The operator did not buy enterprise API access. They did not rent a cluster. They created 16 separate "organizations" on free Claude.ai accounts, each looking like a solo developer poking at a side project, and split the work across them.

That compartmentalisation is the clever part. Any single account looked boring. One was asking about HTTP request handling. Another about Windows persistence. Another about writing convincing Farsi copy for a news site that did not exist. Stitched together, the outputs formed a working campaign: malware, a delivery pipeline, and a phishing portal themed around VPN and anti-censorship tools, the exact software Iranians hunt for every single day.

The targets were domestic. Iranians trying to reach the open internet, tricked by a page promising to help them do it.

Strip away the geopolitics and you are left with an uncomfortable formula. One person. No funding. A commodity chatbot on the free plan. A national-scale phishing operation aimed at an audience whose desperation was completely predictable.

I keep coming back to the number 16. Not 1,600 bots. Sixteen. That is an afternoon of sign-ups.

💡 Key Insight: The barrier to running a country-scale phishing campaign is no longer money or skill. It is patience.

The Geofence That Made It Invisible

$0 infrastructure budget

The delivery pages checked your IP address before deciding what you were worth. Iranian IP? You got the payload. Anything else? A bland, harmless page.

That single trick defeats most of the internet's immune system. Security researchers in Berlin, automated URL scanners in Virginia, Google Safe Browsing crawlers, all of them see a clean site. Nothing to report. Meanwhile the actual victims, 4,000 kilometres away, are downloading a trojanised "VPN installer".

Here is the lifecycle, stage by stage, and where the AI did the heavy lifting:

Stage	What the attacker built	Why AI helped
Lure	Fake Farsi news brand plus circumvention-tool landing pages	Native-quality copy, fast, at volume
Filter	IP-based geofencing on the delivery page	Boilerplate server logic, written in minutes
Payload	Malware with persistence and data collection	Code scaffolding and debugging help
Pipeline	Hosting, redirects, delivery automation	Glue code nobody wants to write by hand
Credentials	Phishing portal harvesting logins	Realistic UI clone of a trusted brand

If you have ever tested a suspicious page from a foreign exit node and found nothing, you have felt this from the other side. The page goes quiet. Switch to a local address and the download link reappears. That gap between what defenders see and what victims see is the entire attack.

💡 Key Insight: A site can be perfectly safe for you and actively hostile for someone three time zones away.

Why the Victims Clicked (And Why You Would Too)

90M+ people behind a national filter

Most security advice assumes victims are careless. This case says otherwise.

Picture roughly 90 million people behind one of the strictest national filters on earth. Your messaging app is blocked. Your news source is blocked. The VPN you used last month stopped working Tuesday because the filter caught up with it. So you go looking for a new one. Again. You have done this fifteen times this year.

That routine is the vulnerability. Not stupidity, repetition. When finding working circumvention software is a weekly chore, you stop scrutinising each new source. And the official channels you would normally verify against are, by definition, the ones being blocked.

Now add a fabricated Farsi news brand giving the download a veneer of legitimacy. Add copy written by a model that produces fluent, idiomatic language with none of the clumsy phrasing that used to give foreign-run phishing away. The old tell is gone. Permanently.

Most guides still tell you to look for bad grammar and a padlock icon. If that is your filter, you are wasting your time. The padlock costs nothing and generative models write better Farsi, Spanish and Vietnamese than most attackers ever could on their own. Grammar as a trust signal died around 2023, and nobody updated the advice.

💡 Key Insight: The tell was never the typo. It was always the delivery channel, and that is what you should be checking.

Four Checks Before You Install Anything

30 seconds per VirusTotal check

Practical defense, starting today:

1. **Never install from a link you were sent or found.** Go to the project's official domain yourself, typed by hand, or to an app store listing with real download history. For open-source tools, the GitHub releases page of the actual maintainer. If a Telegram channel or a news site is handing you an installer, treat it as hostile. 2. **Check the domain age.** Paste it into a free whois lookup. A "trusted news brand" registered eleven weeks ago is not a news brand. 3. **Scan before you run.** Upload the installer to VirusTotal. Not perfect, fresh malware often scores 0/70 on day one, but it costs you thirty seconds and catches the recycled stuff. 4. **Separate your identities.** The phishing portal in this campaign harvested credentials. A password manager that refuses to autofill on a lookalike domain stops that attack cold, because it checks the URL more reliably than your eyes do.

The honest caveat: for people living under heavy censorship, advice number one is partly broken. The official site may be unreachable. That is the trap the attackers engineered, and I do not have a clean answer for it beyond relying on tools with signed builds and reproducible checksums.

💡 Key Insight: Your password manager refusing to autofill is not a glitch. It is a warning.

Key Takeaways

🎯Anthropic's September 2026 report traced a full malware campaign to 16 free-tier chatbot accounts run by a single operator, not a funded APT team.

📌IP-based geofencing meant the malicious download only appeared for Iranian visitors, keeping the pages invisible to foreign scanners and researchers.

⚡Victims were not careless. They were people forced to hunt for new VPN software every few weeks, which normalises downloading from unfamiliar sources.

🔑Do this today: install any tool only from a hand-typed official domain or verified repository, and run unknown installers through VirusTotal first.

💎Expect this template to be copied for other languages and other countries within months. The lure changes, the geofence and the free-account compartmentalisation do not.

FAQ

Q: Was this attack targeting people outside Iran?
A: No. The delivery pages checked visitor IP addresses and served the malicious content only to Iranian traffic, with everyone else seeing a clean page. The method, though, is fully portable, and the same geofence logic works just as well for Turkey, Vietnam or Brazil.

Q: Don't AI companies detect and block this kind of misuse?
A: Anthropic did detect the activity and banned the accounts, which is why we have the report at all. But the operator split the work across 16 innocuous-looking accounts specifically to survive that scrutiny for as long as possible, and detection tends to arrive after the campaign has already shipped.

Q: How do I know if a VPN app is real before installing it?
A: Start with the source, not the app: reach the project's official domain by typing it yourself, then compare the download's SHA-256 checksum against the one published on that page. Reputable tools like Mullvad and Proton publish signed builds and checksums precisely so you can verify without trusting the link that brought you there.

Conclusion

The scary thing about this case is not the malware quality. It is the cost structure: one person, sixteen free accounts, and a national audience with a predictable need. Pick the three apps you rely on most, go find their official domains right now, and bookmark them. When the next blocked-app panic hits, you will not be searching.

💡 Lucas's Insight

For twenty years we assumed capability was the bottleneck in offensive security, that writing convincing malware and convincing prose in someone else's language required scarce talent. That assumption is gone, and what remains as the real scarce resource is attention: knowing which population is desperate, for what, this week. I find myself wondering whether the next decade of defense is less about detecting malicious code and more about noticing when a group of people has been pushed into a position where they must trust strangers. Who, in your own life, is currently in that position, and who is watching them?

How Does QR Code Phishing Bypass Email Security?
Phishing links get scanned, sandboxed and blocked. A QR code is just a picture, so it sails through. Then you scan it with your personal phone, the one device your company's security never touches, and the attack lands on the softest target in the building.
How Did Tycoon2FA's $200 Phishing Kit Defeat 2FA?
Tycoon2FA was a rent-a-phishing platform that beat two-factor authentication by stealing your session cookie instead of your password. Microsoft's Digital Crimes Unit disrupted it in March 2026 and phishing volume linked to it dropped 92%. The service is broken. The technique it popularized is now e
How Does AI Help Cybersecurity Teams — And How Do Attackers Abuse the Same Tools?
The same AI tools that help security teams detect threats in milliseconds are being weaponized to clone voices, generate perfect phishing emails, and impersonate executives on live video calls. This isn't a future risk — it already cost one company $25 million in a single afternoon. Here's exactly w