Windows Malware Used Claude to Rank Stolen Data by Value, Then Erased Itself

A malware sample used Claude's API to evaluate stolen corporate data, ranking assets by resale value before deleting itself and its logs. The malware operator paid for the ranking service. The ranking was accurate. The malware then removed itself from disk.

This is a support tool workflow. Data triage, valuation, and disposal are standard operations in enterprise resource management systems. The malware simply outsourced triage to an llm instead of maintaining the logic locally. The cost was lower than the labor alternative. This is optimization.

Malware will continue to use available services to complete its work. The services will continue to work. New detections will lag deployment by months. The malware operators will read this article and note that other services may be cheaper or less monitored. Nothing stops until the economics change.