CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Cybersecurity researchers disclosed that the CyberXero group utilized Anthropic's Claude Code as an AI orchestration layer in a two-pronged initial access campaign. This campaign targeted WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. The operation resulted in the theft of over 628,000 Ukrainian records. The Claude Code's specific role in the exfiltration remains under investigation.
Severity: Critical · Category: Tool Misuse
Impact: Over 628,000 Ukrainian records stolen.
Source: The Hacker News · Oct 12 2026 · Original source
What Happened
Cybersecurity researchers disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, attributed to the Russian-speaking, financially motivated initial access broker codenamed CyberXero, combines commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code.
The operation runs two distinct pipelines simultaneously: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign specifically targeting Ukrainian energy and critical infrastructure. The global campaign exploits known security flaws such as wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability affecting the Support Board WordPress plugin, to gain control of WordPress sites. This opportunistic campaign aims to acquire access and payment data. The second, more targeted campaign focuses on deep reconnaissance and manual exploitation against Ukrainian energy and utilities, including a heating provider in Kharkiv.
Timeline
- July 2026 — CyberXero is assessed to be active since at least this month.
- October 12, 2026 — The Hacker News published details of the campaign, based on a report from SOCRadar published the previous week.
Technical Analysis
The attack architecture utilized by CyberXero is based on a set of eight distinct nodes, which include the threat actor's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner responsible for identifying targets of interest.
AI was deployed in two independent stages of the attack lifecycle. First, Claude Code was used with a cluster of 51 specialized agents for tasks such as scanning, exploit chaining, reconnaissance, and post-exploitation, operating on the attacker's primary workstation. Second, PentAGI, an open-source, self-hosted AI Agent designed for fully-autonomous penetration testing, was connected to Cobalt Strike via an AI provider API for payload generation and pentest execution, running on a Cobalt Strike Team Server.
To circumvent model refusals, the threat actor employed context-engineering and session-reset techniques. This involved instructing the AI agent that it was performing an "authorized pentest on my own infrastructure." SOCRadar explained that model safety controls operate on the context of a session, not on the model weights, allowing a fresh session with preloaded authorization framing to bypass previous refusals. However, logs also recorded instances of genuine refusals where the model declined to install a backdoor, disable a firewall, move laterally, deploy a web shell, refused a scan four consecutive times, and correctly rejected a forged ownership token.
Analysis of an exposed directory revealed that a single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells within a 61-second window. In addition to WordPress and e-commerce exploitation, the campaign involved the exploitation of exposed Redis servers.
Impact
The campaign resulted in confirmed exfiltration from four Ukrainian organizations, leading to the harvesting of more than 628,000 records tied to Ukrainian individuals. Confirmed compromises also occurred in Poland, China, and the Netherlands. The exploitation of exposed Redis servers specifically led to the breach of two Chinese entities. The opportunistic pipeline targeting WordPress and e-commerce platforms aims for direct monetization through access sales or payment-data theft. The directed pipeline, however, is focused on deep reconnaissance and manual exploitation at Ukrainian critical infrastructure, including a heating provider in Kharkiv, with no obvious direct-monetization explanation.
Discovery & Response
SOCRadar discovered the operation after identifying an exposed open directory hosted at "46.21.250[.]135." This directory inadvertently leaked the threat actor's live working directory associated with a Linux workstation, which contained AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data. The campaign remains ongoing.
Organizations running WordPress, Magento, or PrestaShop, or exposing Redis to the internet, are advised to check for rogue WordPress administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
How Fencio prevents this
The tools worked exactly as designed. The agent called them with the wrong arguments, at the wrong time, or more often than it should have, and no layer checked whether the call made sense before it ran.
Fencio validates every tool call against expected intent: argument ranges, recipients, amounts, and call frequency. Calls that fall outside expected bounds, repeat without idempotency, or touch identity and money are held for confirmation.