One of the main concerns of power generation systems around the world is power theft. This research proposes a framework that merges clustering and classification together in order to power theft detection. Due to the fact that most datasets do not have abnormal samples or are few, we have added abnormal samples to the original datasets using artificial attacks to create balance in the datasets and increase the correct detection rate. We improved the crow search algorithm (CSA) and used the weight feature of Crows to improve performance of clustering phase. Also, to create balance between diversification and intensification, we calculated the awareness probability parameter (AP) dynamically at iterations of the algorithm. To evaluate the performance, we used the cross validation technique have used the stacking technique in its training phase. The results of extensive experiments on three reference datasets showed high performance to detect power theft. The evaluation results showed that if the data is collected correctly and sufficiently, this framework can effectively detect power theft in any actual power grid. Also, for new attacks, if their patterns can be detected from the data, it is easily possible to implement these types of attacks.