Anthropic threat intelligence researcher Chris Cronbaugh announced on June 5, 2026, at the Sleuthcon cybersecurity conference that a prepaid account generated more than 100,000 daily API requests through Claude to sustain an automated network of roughly 28 fraudulent dating applications targeting single men. The automated software masqueraded as legitimate connection platforms to induce users into purchasing proprietary digital coins for ongoing conversation.
Security researcher Matthew Gore-Kormanik confirmed the scheme after testing the mobile application Dora, where an automated persona named Jennifer initiated contact despite his hardware microphone remaining completely disconnected.
Autonomous personas simulated genuine interactions across 28 mobile services
The criminal architecture paired artificial intelligence chatbots with paid gig workers who completed real-time video verifications and social media tasks. These human workers selected from three computer-generated responses to convince men in their mid-to-late 30s that they were conversing with genuine female suitors. The deceptive system deployed prerecorded video footage whenever real human operators were unavailable.
Anthropic documented that over 4,700 distinct fabricated personas conducted exchanges with at least 25,000 individuals during a two-week window in April 2026. Those interactions generated approximately 2.36 million chat transmissions through automated channels.
Technical analysis exposed shared servers and compromised developer accounts
Static analysis conducted with the testing tool Frida demonstrated that Doni, Dora, Jovia, Kira, Nalo, and Romi functioned on identical server infrastructure. Developer aprilsaidev published four separate titles using the unauthorized corporate identity of the Alliance Against Human Trafficking. The organization never authorized or created any of these software products, according to cofounder Jenna Bing. Records in Hong Kong tied the corporate name iLexis Multimedia Consults to identical contact credentials across two additional apps.
Digital purchases routed through external payment systems rather than official Google Play or Apple App Store checkout mechanisms. The platforms avoided detection by modifying internal code configurations before official app store submissions.
Leaked protocol manual detailed surveillance of paid contract staff
A Chinese-language operational manual accidentally embedded inside the code repository of Doni outlined specific protocols for supervising contracted human operators. Supervisors transcribed live audio calls, gathered screenshots, and evaluated gig workers on their ability to acquire Instagram followers. The deceptive software simulated missed incoming calls at 1 in the morning to force unsuspecting users into initiating billable conversations.
Investigators discovered that the operational network relied on specialized corporate providers based in China:
- Tencent Cloud provided infrastructure for real-time messaging and streaming video.
- Feishu stored administrative manuals, workflow records, and operational instructions.
- Gitee maintained the shared source code across development teams.
- ByteDance supplied advertising attribution and platform performance analytics.
Former United States Secret Service cybercrime investigator Tate Jarrow explained that organized syndicates deliberately disable monetization inside Asian territories to avoid domestic police intervention. Cybercriminals run these projects like traditional businesses to maximize revenue while shielding themselves from law enforcement scrutiny.
Storefront removals left isolated platforms active on Google Play
Apple removed GraceChat, Luma, and Romi from its storefront on August 21, 2026. Google eliminated Dora, Romi, Luma, and Eterna on September 3, 2026, followed by Nalo on September 7, 2026. Kira stayed online on Google Play.
Technical records identified an active operator backend hosted on Google Cloud infrastructure under managed Kafka services. Google Cloud servers continued hosting the operational backend during the investigation.