CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

What happened

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress (content management system) sites, e-commerce platforms, and critical infrastructure entities in Ukraine. CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records  Ravie Lakshmanan  Oct 12, 2026 Web Security / Cybercrime Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine.

Other confirmed compromises have occurred in Poland, China, and the Netherlands. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed to a Russian-speaking, financially motivated initial access broker codenamed CyberXero .

The threat actor (the person or group behind an attack) is assessed to be active since at least July 2026. "The operation runs two pipelines at once: a global, automated campaign against WordPress and e-commerce platforms, and a curated, manual campaign against Ukrainian energy and critical infrastructure," SOCRadar said in a report published last week.