{"data":{"id":"3d5edb0b-564a-4cab-b2ac-376b3d2e7454","title":"CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records","summary":"Cybersecurity researchers disclosed a two-pronged, AI-augmented initial access campaign against WordPress sites, e-commerce platforms and Ukrainian critical infrastructure, attributed to a financially motivated broker codenamed CyberXero and active since at least July 2026. The operation pairs Cobalt Strike with an AI orchestration layer built on Anthropic's Claude Code, and it exploited wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection in the Support Board WordPress plugin. The campaign reportedly exfiltrated more than 628,000 records tied to Ukrainian individuals from four organizations, and it remains ongoing.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html","publishedAt":"2026-10-12T07:26:12.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["jailbreak","supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Claude Code","PentAGI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-12T07:26:12.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0054"]}}