CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals.
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815 , an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control of WordPress sites.
The opportunistic campaign aimed at WordPress and e-commerce platforms is designed for access and payment data, while the second campaign is a lot more targeted and geared towards deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.
SOCRadar said it discovered the operation after it identified an exposed open directory hosted at "46.21.250[.]135" that leaked the threat actor's live working directory associated with a Linux workstation, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data.
The attack architecture is based on a set of eight distinct nodes, including the threat actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner that's responsible for identifying targets of interest.
The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero .
Between April and mid-September 2026, the adversary, who goes by the online alias "masterblack" on cybercrime forums, has been observed orchestrating multiple attack campaigns - The threat actor has also run an invoice-fraud engine generating over 2.4 million email, SMS, and WhatsApp messages and 622,666 personalized invoice links targeting Brazilian consumers and corporations before going offline in mid-September.
CyberXero is said to have deployed AI in two independent stages of the attack lifecycle - To get around model refusals, the threat actor has been observed using context-engineering and session-reset techniques, instructing the agent they were running an "authorized pentest on my own infrastructure." "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar explained.
Analysis of the exposed directory shows that a single automated execution scanned 4,708 targets, confirming access to 429 WordPress administration panels, followed by the deployment of 32 web shells in a 61-second window.
What happened
The campaign is estimated to have resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals.
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
What changed
The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815 , an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control of WordPress sites.
The opportunistic campaign aimed at WordPress and e-commerce platforms is designed for access and payment data, while the second campaign is a lot more targeted and geared towards deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.
Who is affected
SOCRadar said it discovered the operation after it identified an exposed open directory hosted at "46.21.250[.]135" that leaked the threat actor's live working directory associated with a Linux workstation, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data.
The attack architecture is based on a set of eight distinct nodes, including the threat actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner that's responsible for identifying targets of interest.
Why it matters
The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero .
Between April and mid-September 2026, the adversary, who goes by the online alias "masterblack" on cybercrime forums, has been observed orchestrating multiple attack campaigns - The threat actor has also run an invoice-fraud engine generating over 2.4 million email, SMS, and WhatsApp messages and 622,666 personalized invoice links targeting Brazilian consumers and corporations before going offline in mid-September.
Response
CyberXero is said to have deployed AI in two independent stages of the attack lifecycle - To get around model refusals, the threat actor has been observed using context-engineering and session-reset techniques, instructing the agent they were running an "authorized pentest on my own infrastructure." "Model safety controls act on the context of a session, not on the model weights, so a refusal in one session does not carry into the next," SOCRadar explained.
Analysis of the exposed directory shows that a single automated execution scanned 4,708 targets, confirming access to 429 WordPress administration panels, followed by the deployment of 32 web shells in a 61-second window.
What security teams should do
Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
Attribution
The Hacker News: Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.