AI-Assisted Hacking Campaign Steals 628,000 Ukrainian Records and Targets WordPress Sites Worldwide

Researchers have disclosed an AI-augmented campaign run by CyberXero, a Russian-speaking, financially motivated initial access broker assessed to be active since at least July 2026. The group combines commodity offensive tools such as Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code. SOCRadar says the operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure.

The global campaign uses known security flaws, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection flaw in the Support Board WordPress plugin, to take over sites. It is designed to obtain access and payment data. The targeted campaign focuses on deep reconnaissance and manual exploitation, including a heating provider in Kharkiv. Confirmed data theft from four Ukrainian organisations led to more than 628,000 records on Ukrainian individuals being harvested, and compromises have also been confirmed in Poland, China and the Netherlands.

SOCRadar found the operation after discovering an exposed open directory that leaked the attacker's working files, including AI session logs, scripts with plaintext tokens, and stolen victim data. In one automated run, 4,708 targets were scanned, access to 429 WordPress administration panels was confirmed, and 32 web shells were deployed within 61 seconds. The campaign remains ongoing.