CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Summary

Cybersecurity researchers disclosed a two-pronged, AI-augmented initial access campaign against WordPress sites, e-commerce platforms and Ukrainian critical infrastructure, attributed to a financially motivated broker codenamed CyberXero and active since at least July 2026. The operation pairs Cobalt Strike with an AI orchestration layer built on Anthropic's Claude Code, and it exploited wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection in the Support Board WordPress plugin. The campaign reportedly exfiltrated more than 628,000 records tied to Ukrainian individuals from four organizations, and it remains ongoing.

Related items

• MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
• InfoAI’s quiet safety gatekeepers are stepping into the spotlightSame vendor · CNBC Technology
• InfoAnthropic is cutting off its internal evaluations from the internetSame vendor · The Verge (AI)
• MediumARTEX AI, Claude agents used in cyberattacks on South Korean banksSame vendor · BleepingComputer
• InfoRogue Anthropic AI agent gave police fake tip in unsolved murder caseSame vendor · BBC Technology