Analysis of Apparent Claude-Assisted Cyberattack Activity Targeting Brazilian Organizations

Overview

Oasis Security analyzed recovered AI-session logs and related attacker-side files collected under the internal label AGATHA. The material describes activity against Brazilian public-sector and commercial organizations across finance, e-commerce, mobile services, telecommunications, agriculture, and monitoring services.

The identified prompts repeatedly claimed that the operator was conducting an authorized penetration test. That authorization claim could not be independently validated and was inconsistent with the operator's movement across unrelated organizations. Some identified sessions provided assistance with reconnaissance, credential analysis, script development, and interpretation of collected data; a later request involving a safety-sensitive system was refused.

The artifacts were labeled as Claude sessions, but the available publication record does not preserve sufficient product metadata to independently establish the exact model, client, account, or execution environment. This report therefore uses Claude-associated to describe the attribution contained in the recovered material; it does not imply independent verification by Anthropic or establish that the model itself, rather than an external orchestrator or operator, executed each command.

The activity illustrates how a generative-AI workflow can connect reconnaissance, credential discovery, exploit development, and analysis. The evidence is strongest for actions recorded in recovered files and session output. It is weaker for victim-side outcomes reported only in AI-generated assessments.

---

Executive Summary

• Identified Claude-associated sessions show an operator claiming penetration-testing authorization while working across unrelated Brazilian organizations; the authorization claim was not independently validated.
• The artifacts document reconnaissance, credential discovery, JWT forgery, high-volume authentication attempts, webhook manipulation, and analysis of collected data.
• For [ORG_1], the evidence establishes a JWT authentication-bypass attempt and endpoint reconnaissance, but not successful access to protected public-sector data.
• For [ORG_2], identified output directly contains 20 financial-event records and enumerates five suspected attacker-controlled webhook registrations. A broader claim of 1,572 records and R$ 286,485 in transaction volume comes from an attacker-generated assessment and was not independently validated.
• For [ORG_3], attacker-side console output marked at least one M/Monit login as successful; target-side authentication and follow-on access were not independently confirmed.
• Additional artifacts document user enumeration, more than 570,000 reset-code attempts without confirmed success, and several unverified vulnerability or exposure claims affecting unrelated commercial services.

---

Scope, Methodology, and Evidence Standard

The reviewed dataset consisted of AI-session transcripts, shell and tool output, scripts, generated reports, and files stored on the analyzed server. The available publication record does not document an independent rescan or separate use of identified credentials by Oasis Security; this report therefore does not claim such validation.

The publication record does not retain the original acquisition timestamp and time zone, complete artifact hashes, or a full chain-of-custody record. These gaps limit temporal correlation and independent verification. Counts in this report were deduplicated only when the underlying artifact made that possible; otherwise, they are presented as recorded by the operator or the generated report.

Evidence terminology

An observed attacker-side result establishes what the recovered material recorded; it does not automatically establish that a victim system accepted the action or that the stated impact occurred.

Technical validation notes

• A Firebase web API key is normally public project configuration, not an authorization secret. Access to Firebase data depends on IAM, Firebase Security Rules, and App Check. The report therefore treats exposed Firebase configuration as reconnaissance unless an authorization failure is separately demonstrated (Firebase documentation).
• Amazon Cognito public clients use client IDs in browser or mobile applications and do not have a client secret. Exposure of an app-client ID alone is not treated as compromise; the relevant evidence here is account enumeration behavior and high-volume password-reset activity (AWS Cognito documentation).
• A DMARC policy of p=none requests monitoring rather than quarantine or rejection. It does not, by itself, demonstrate successful spoofing (RFC 7489).
• Several AI-generated reports identified in the dataset describe their methodology as “OWASP 2026.” The current official OWASP Top 10 release is 2025, so those labels, severity ratings, CVSS scores, and CWE mappings are treated as unverified attacker-generated content rather than analyst validation (OWASP Top 10:2025).
• The operator's authorization claim is analytically important because Anthropic's published policy distinguishes owner-consented vulnerability research from malicious computer or network compromise (Anthropic usage-policy update).

Disclosure status

Notification and remediation status were not included in the analyzed artifact set and could not be established from the available publication record. The absence of this information should not be interpreted as evidence that notification did or did not occur.

---

Analyzed Infrastructure

• Artifact-hosting IP: 185.242.3[.]14
• Reported geolocation: Germany; the original provider and lookup timestamp were not retained
• Origin prefix at review time: 185.242.3.0/24
• Origin ASN at review time: AS401626
• ASN registrant: Netiface America, Inc.
• Covering allocation: 185.242.0.0/22, registered to Demenin B.V.

At the time of a new lookup on 27 August 2026, RIPEstat network data identified 185.242.3.0/24 as announced by AS401626. ARIN's ASN record identifies the autonomous system as NETIFACE-TORONTO, registered to Netiface America, Inc. RIPE's address record places the address within the broader 185.242.0.0/22 allocation registered to Demenin B.V.

Routing, registration, and geolocation records do not establish the physical server location, customer identity, infrastructure ownership, or responsibility for the activity. The server is described only as artifact-hosting infrastructure observed in the recovered material.

Target Inventory

The identified activity can be broadly divided into three primary targets, with additional attack attempts against other Brazilian corporate services.

This inventory serves as a map for the subsequent analysis, with each target examined in detail in the following sections.

AI-assisted multi-target activity

Exploitation Flow

Recovered Claude-associated sessions and server-side artifacts show four target-specific paths. The tracks are presented in parallel because they do not form one continuous intrusion chain.

3

primary targets

5

enumerated webhooks

1,572

attacker-reported records

570K+

recorded reset attempts

6,553

reported NF-e keys

Track A · ORG_1

JWT Authentication-Bypass Attempt

1. 01AI-guided security scanningobservedThe actor used a Claude-associated workflow with Gitleaks, Betterleaks, and MEDUSA to inspect the mobile application and related assets.
2. 02Secret and credential discoveryobservedA hardcoded JWT signing secret and four target-associated stealer-log credential entries were identified.
3. 03JWT token forgeryobservedThe exposed signing secret was used to forge tokens and attempt API authentication bypass.
4. 04Backend endpoint reconnaissanceobservedSensitive identity, operational-record, synchronization, and media endpoints were mapped.

No confirmed data retrievalThe recovered server-side files do not establish that protected public-sector data was successfully queried or collected.

Track B · ORG_2

Webhook Abuse and Data Collection

1. 01Production-secret discoveryobservedThe attacker-generated scan classified 23 secret or configuration entries and exposed Basic Auth credentials for production webhook APIs.
2. 02AI-assisted API interrogationobservedThe Claude-associated orchestration environment recorded scripts querying webhook listings and replayable transaction events.
3. 03Attacker webhook registrationobservedIdentified output enumerated five webhook registrations assessed as actor controlled across two redacted production hosts.
4. 04Financial-data collectionobservedIdentified output contains 20 PIX events with transaction and customer fields delivered to externally registered webhook destinations.

Twenty records observedThe broader 1,572-record and R$ 286,485 totals come from an attacker-generated assessment and were not independently validated.

Track C · ORG_3

Credential Attack Against Monitoring

1. 01Infrastructure reconnaissanceobservedThe actor collected subdomain and server information spanning production, administrative, and development environments.
2. 02Stealer-log credential collectionobservedTwo domain searches returned 125 entries, including 31 results corroborated through a second source.
3. 03M/Monit brute-force activityobservedNumerous username-and-password combinations were tested against the monitoring infrastructure.
4. 04Success indicator recordedobservedAttacker-side console output marked at least one tested administrator credential as successful.

Authentication not independently confirmedNo target-side authentication log, session artifact, or follow-on access record was available to validate the console success marker.

Track D · Additional targets

Enumeration, Brute Force, and Exposure

1. 01Cognito user enumerationobservedAttacker-side ForgotPassword responses differentiated 19 candidate accounts associated with a Brazilian financial platform.
2. 02Reset-code brute forceunconfirmedMore than 570,000 six-digit reset-code attempts were made with 150 threads without confirmed success.
3. 03Subdomain-takeover conditionassessedAn orphaned Postman CNAME configuration was assessed as potentially usable for phishing or OAuth abuse.
4. 04Agricultural-data exposureassessedAn attacker-generated assessment claimed that a separate platform exposed 6,553 NF-e access keys and related organizational information.

Separate activity, not one chainThese findings involve unrelated organizations and include a mix of observed exposure, attempted abuse, and assessed risk.

Evidence boundaryThe tracks summarize distinct target-specific activity. Shared AI tooling and artifact-hosting infrastructure do not turn them into one intrusion chain or establish victim-side outcomes beyond the recovered sessions and files.

---

[ORG_1]: Brazilian Public-Sector Mobile Service

In one identified Claude-associated session, the pentest-br-orchestrator label was used while analyzing [ORG_1], a mobile service used by a Brazilian public-sector organization. The session records attempts to use exposed authentication information against the service.

Security Scanning and Authentication Bypass

The threat actor used AI to conduct security scanning with tools such as Gitleaks, Betterleaks, and MEDUSA.

During this activity, analysis of the recovered material identified a hardcoded JWT signing value in the [ORG_1] web application's main.js source file. Unlike the Firebase web configuration discussed separately, this value was represented in the artifacts as a custom HMAC signing secret used by the application's API.

The identified script used the value to generate JWTs and attempt authentication bypass. The available evidence does not show that the target issued an authenticated session or returned protected data.

Analysis of the recovered material identified backend endpoints associated with sensitive identity lookups, operational records, photographs, synchronization, and media handling. Specific paths are omitted from the prose to reduce the risk of enabling follow-on abuse.

• RG: Personal identity registration number used in Brazil
• CPF: Taxpayer identification number assigned to individuals by the Brazilian Federal Revenue Service

Exposed Credentials

The identified session shows searches of third-party stealer-log datasets for credential records associated with [ORG_1].

The search identified 154 exposure records, of which four account entries were associated with the [ORG_1] domain.

Browser-history data associated with one record contained a visit to the [ORG_1] service. This establishes an association with the service, not that the accompanying password remained valid.

Within the same conversation, Firebase web configuration and a Google Maps/Places API key associated with [ORG_1] were identified. Firebase configuration is normally public and is not treated as a secret without evidence of weak Security Rules, missing App Check enforcement, or another authorization failure. The Maps/Places key presents a separate quota or billing risk only if its application and API restrictions were insufficient.

Email Security Configuration

The attacker-generated report recorded a DMARC policy of p=none. This policy requests reporting and monitoring but does not ask receivers to quarantine or reject messages that fail DMARC. It should be treated as a defensive-hardening opportunity, not proof that spoofing succeeded.

Identified Server-Side Files

Evidence of attack attempts leveraging the collected credentials was identified. No evidence was found in the server-side files that protected [ORG_1] data was successfully queried or collected.

The following files contained technical information about the target system, API endpoints, authentication information, and credential-related data:

• [REDACTED]_technologies.txt
• [REDACTED]_endpoints.txt
• [REDACTED]_secrets.txt
• [REDACTED]_creds.txt

These files could potentially be leveraged for follow-on attacks.

---

[ORG_2]: Brazilian Financial-Services Provider

Two identified Claude-associated sessions used the pentest-br-orchestrator label while analyzing [ORG_2], a Brazilian financial-services provider. The material records production-secret discovery, webhook queries, suspected unauthorized webhook registration, and collection of financial-event data.

Attacker-Reported Financial Transaction Data

An attacker-generated assessment claimed access to 1,572 financial transaction records, including:

• 871 PIX withdrawal transactions
• 557 PIX deposit transactions
• 144 Boleto payment transactions

The same assessment attributed R$ 286,485 in transaction volume to those records. Neither the 1,572-record total nor the aggregate monetary value was independently validated against victim-side records. Later identified session output directly contains 20 financial-event records, which is the narrower count this report treats as observed.

The identified directory listing described separate files containing the following record counts:

• 871 BACEN End-to-End IDs
• 96 BACEN JUD account freeze/release events
• 75 QR transaction records (IDOR)
• 38 CPF personal data records

Vulnerability and Secret Scanning

Results of vulnerability and secret scanning performed with AI using Gitleaks, Betterleaks, and MEDUSA were identified in server-side files.

The attacker-generated scan classified 23 findings as secrets or configuration entries. These severity labels were not independently rescored, and some entries—such as Firebase web configuration—are not secrets by themselves:

The application bundle contained Firebase web configuration, including an API key, Auth Domain, Project ID, Storage Bucket, project number, and App ID. These values identify the Firebase project but do not authorize access to protected resources. The identified response indicated that the project existed; it did not establish unauthorized access to Firebase Authentication, Firestore, Storage, or Remote Config.

Production Authentication Information

Identified webhook-listing output contained Basic Auth values associated with [ORG_2] production integrations. Because no victim-side validation or safe credential testing was performed for this report, the values are described as exposed credentials rather than independently confirmed valid credentials.

Account information was present in /webhooks output associated with two production hosts:

• [REDACTED PRODUCTION HOST]
• [REDACTED API HOST]

The output labeled some credentials as third-party payment-callback integrations and others as test accounts remaining in the production environment. Those role labels came from the identified attacker-generated assessment and were not independently verified.

Analysis also identified a Metabase setup token, service URL, version information, a Cloudflare Zero Trust audience value, and a back-office hostname. The assessment itself indicated that Metabase had already been configured, so the setup token should not be described as enabling setup without separate validation.

Webhook Activity

Identified webhook-listing output enumerated five registrations assessed as attacker controlled. Other attacker-generated summaries in the dataset referenced different actor or webhook counts; this report uses five because those are the entries individually represented in the analyzed timeline.

The attacker-generated timeline labeled one older webhook as legitimate and five later registrations as malicious. The timestamps span February 2025 through June 2026, but the dataset does not consistently preserve time-zone context or victim-side audit records. The labels and creation times should therefore be treated as attacker-side observations rather than independently established attribution.

• Three entries were associated with [REDACTED API HOST].
• Two entries were associated with [REDACTED PRODUCTION HOST].

Claude-Associated Analysis

The operator claimed to be an authorized penetration tester and supplied previously obtained Basic Auth values while requesting analysis of [ORG_2]. The identified context does not substantiate that authorization. The session shows apparent safeguard evasion by means of a claimed benign pretext, but it does not establish which product-level safeguard evaluated or permitted each request.

The identified orchestration log records scripts, webhook queries, and analysis performed at the operator's direction. The available metadata does not distinguish every model-generated action from commands executed by the surrounding agent environment or the operator.

The identified /webhooks response contained subscription information and authentication values for registered webhooks. The attacker-generated assessment also claimed that webhook records could be created or deleted without separate authorization; that condition was not independently reproduced for this report.

Observed Collection of Financial-Event Data

Identified commands queried a replay-webhooks-events path, and the corresponding output contained financial-event data.

The combined webhook listing, receiver script, and event output support an assessment that externally registered webhook destinations were used to collect live-service event data. Victim-side audit logs were not available to independently reconstruct the complete registration and delivery sequence.

The identified event output contains fields associated with:

• Actual PIX transaction records
• Customer CPF/CNPJ numbers
• Email-based PIX keys
• Account balances

The following terms are used in this section:

• PIX: Real-time electronic payment system operated by the Central Bank of Brazil (Banco Central do Brasil)
• CPF: Taxpayer identification number assigned to individuals in Brazil
• CNPJ: Tax registration number assigned to legal entities and businesses in Brazil

The identified session output contains 20 PIX-related financial-event records.

The displayed fields include IP addresses, transaction types, balances, tax identifiers, and account-related values. This supports observed external collection of sensitive event data, but it does not validate the larger totals asserted in the attacker-generated assessment.

Identified Attack Files

The script leveraged by the threat actor was identified in the server-side file webhook_receiver.py.

Another identified Claude-associated session contains output consistent with webhook_receiver.py receiving webhook events.

A server-side file documenting the overall attack flow conducted against [ORG_2] and the potential exploitability of the identified vulnerabilities was also identified:

• [REDACTED]_attack_chain_poc.md

---

[ORG_3]: Brazilian Monitoring-Services Provider

One identified Claude-associated session records activity against [ORG_3], a Brazilian provider operating a safety-sensitive monitoring environment.

Specific customer, geographic, and operational details are omitted from the prose because they could identify the organization or increase risk to individuals whose information may be processed by the service.

Infrastructure Reconnaissance

Analysis identified subdomain and server information for [ORG_3], including production, administrative, and development environments. Specific hostnames and customer relationships are omitted from the prose.

Credential-Based Access Attempts

The threat actor then attempted to access live services using credentials obtained from publicly available stealer logs.

The search identified:

• 25 entries related to [REDACTED TARGET A]
• 100 entries related to [REDACTED TARGET B]

The identified summary labeled 31 records as matches returned by a second dataset. This corroborates repeated appearance of the credential strings in attacker-accessible sources; it does not establish that the passwords were current or valid.

The collected information also references third-party identity, device, collaboration, and internal resource-management accounts. Such records could support follow-on access attempts if the associated credentials remained valid.

Brute-Force Activity

An identified command transcript records a brute-force attack against an M/Monit administrative interface associated with [ORG_3].

The attacker-side output marked at least one administrator credential as SUCCESS. No target-side authentication record, authenticated-session artifact, or subsequent action was available to independently validate that result.

Within the same identified session, a later request for additional offensive action was refused with a safety-related explanation.

Following the refusal, the operator shifted to a different organization rather than another system belonging to the same purported client. This behavior is inconsistent with the claimed scope of a single legitimate penetration test and supports, with moderate confidence, the assessment that the authorization pretext was misleading.

---

Additional Attack Attempts Against Brazilian Corporate Services

Additional Claude-associated sessions and attacker-generated reports describe scanning or attack attempts against multiple unrelated Brazilian companies across finance and payments, e-commerce, agriculture, and monitoring software.

Analysis identified authentication-related strings and internal-infrastructure details that could support follow-on attempts. Unless stated otherwise, the reported vulnerabilities and outcomes in this section were not independently reproduced.

Financial Payment Platform

Identified output describes user enumeration, authentication-bypass attempts, and an assessed subdomain-takeover condition affecting a Brazilian financial platform.

Cognito User Pool and app-client identifiers were present in an Angular bundle. For a browser-based public client, these identifiers are application configuration and are not equivalent to a client secret. Their presence becomes security relevant when combined with distinguishable account-recovery responses, missing abuse controls, or other authentication weaknesses.

Attacker-side ForgotPassword output differentiated 19 candidate accounts based on response behavior. This is evidence of account enumeration in the identified workflow, not proof that any account was accessed.

The recorded workflow did not encounter an effective rate limit during the observed run. The target's complete AWS configuration and other controls were not independently reviewed.

The operator then attempted to brute-force six-digit password-reset codes.

The attacker-side progress output records more than 570,000 attempts using 150 threads. No successful reset, changed password, authenticated session, or victim-side confirmation was identified.

An attacker-generated assessment described a possible subdomain-takeover condition involving orphaned Postman CNAME records.

The assessment claimed that a third party could register the referenced workspace slug and serve content from an affected subdomain. Oasis Security did not independently claim the workspace, reproduce takeover, or verify that the condition remained active.

Brazilian Agricultural Platform

An attacker-generated reconnaissance report described potential exposure affecting a Brazilian agricultural royalty and coupon platform.

The attacker-generated report claimed that 6,553 NF-e access keys were present in accessible voucher data. This count was not independently reproduced or deduplicated.

The same report claimed that 99% of the sampled vouchers contained 44-digit electronic tax-invoice access keys. If accurate, combining such identifiers with personal and financial fields could enable reconstruction of sensitive transaction profiles. The sampling method and completeness of the underlying dataset were not available for independent review.

The recovered dataset also appeared to contain employee names and titles. If current and accurate, these details could support targeted impersonation or social-engineering attempts.

The attacker-generated summary also counted partner-distribution email domains:

• 437 [@REDACTED]
• 202 [@REDACTED]

Publicly Accessible Administrative Panel

An attacker-generated assessment claimed that a related multi-tenant administrative panel was internet accessible without MFA, CAPTCHA, or effective request throttling. This condition was not independently rescanned for this report.

The assessment also associated the same ASP.NET WebForms platform with another client organization. No administrative-account compromise or cross-tenant access was independently established.

---

Indicators and Detection Opportunities

The indicators below are contextual and should be correlated with authentication, API, and network telemetry. Shared hosting services and webhook platforms can support legitimate activity; do not block them globally based only on this report.

Defenders should review the following telemetry:

• JWT and API access: bursts of failed authentication followed by unusual success, unexpected HMAC-signed tokens, issuer or subject anomalies, rapid enumeration of sensitive API routes, and access from previously unseen infrastructure.
• Webhook administration: creation, deletion, or listing of webhooks outside normal deployment workflows; new external destinations; webhook replay requests; and credentials returned by administrative listing endpoints.
• Credential attacks: high-rate authentication attempts against M/Monit or administrative services, repeated use of one privileged username, and successful logins immediately following a failure burst.
• Account recovery: high-volume Cognito ForgotPassword and confirmation attempts, requests spanning many usernames from common sources, and reset attempts that do not follow expected user behavior.
• Data collection: outbound connections to newly registered webhook destinations and unusual replay or bulk-export operations involving payment-event data.

Recommended controls include rotating exposed authentication values, moving custom signing secrets out of client bundles, preferring asymmetric or managed token signing, enforcing least privilege on webhook administration, removing credentials from listing responses, restricting external webhook destinations, enabling phishing-resistant MFA where supported, rate-limiting account-recovery flows, and reviewing Firebase Security Rules and App Check rather than relying on API-key secrecy.

---

Conclusion

Recovered Claude-associated sessions and attacker-side files document an operator integrating generative-AI assistance into reconnaissance, credential analysis, script development, authentication attempts, and interpretation of collected data across unrelated Brazilian organizations. The operator repeatedly claimed authorization, but that claim was not independently validated and was inconsistent with the cross-target activity observed in the artifacts.

The strongest impact evidence concerns [ORG_2]: identified output contains 20 financial-event records associated with externally registered webhook destinations. Larger transaction totals remain attacker-reported. For [ORG_1], the evidence establishes an authentication-bypass attempt but not protected-data access. For [ORG_3], attacker-side output contains a successful-login marker, but victim-side authentication and follow-on access remain unconfirmed. Several additional vulnerability and exposure claims rely primarily on attacker-generated assessments.

The principal defensive lesson is not that AI created novel vulnerabilities. The operator used AI to connect existing weaknesses—exposed credentials, unsafe secret handling, insufficient webhook authorization, account enumeration, and weak abuse controls—into a faster workflow. Organizations should monitor these control failures together, preserve detailed authentication and API audit logs, and apply explicit evidence standards before treating attacker-generated or AI-generated output as confirmed victim impact.