CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
thehackernews.com Oct 12, 2026

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

AI-summarised brief · reviewed before publication

Cybersecurity researchers have uncovered a dual‑track AI‑enhanced intrusion campaign run by a Russian‑speaking broker known as CyberXero. The group combines off‑the‑shelf tools such as Cobalt Strike with Anthropic’s Claude Code to automate attacks on vulnerable WordPress and e‑commerce sites while manually targeting Ukrainian energy and critical‑infrastructure operators. Exploiting flaws like CVE‑2026‑63030, CVE‑2026‑60137 and a SQL‑injection bug in the Support Board plugin, the automated pipeline scanned 4,708 sites, seized 429 admin panels and deployed 32 web shells within a minute. The focused pipeline breached four Ukrainian entities, exfiltrating over 628,000 personal records, and also compromised assets in Poland, China and the Netherlands. Open‑directory leaks revealed AI session logs, plaintext tokens and toolkits, confirming the operation remains active.

💡 Why It Matters

  • · By integrating generative AI to bypass model safeguards, CyberXero demonstrates a scalable method for cyber‑criminals to accelerate large‑scale data theft while retaining the ability to conduct precision attacks on critical infrastructure.