Hades Decoy Anthropic Traffic

Duo Tech@duotech

•updated Jun 9, 2026•1•0•5

Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.