Researchers have disclosed a two-pronged, AI-augmented initial-access campaign targeting WordPress sites, e-commerce platforms and Ukrainian critical-infrastructure entities. The operation pairs commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, and is attributed to a Russian-speaking, financially motivated initial-access broker codenamed CyberXero, assessed active since at least July 2026. SOCRadar reports two pipelines running at once: a global automated campaign against WordPress and e-commerce platforms exploiting flaws including wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection in the Support Board WordPress plugin, plus a curated manual campaign against Ukrainian energy and critical infrastructure. The campaign has produced confirmed exfiltration from four Ukrainian organisations — more than 628,000 records tied to Ukrainian individuals — with other confirmed compromises in Poland, China and the Netherlands. SOCRadar discovered an exposed open directory that leaked the actor's working directory, including AI session logs, scripts with plaintext tokens and AI agent configurations. The campaign remains ongoing, spotlighting AI-assisted initial access at commodity scale.

• Source article