CyberXero used Claude Code agent cluster in attacks, stealing 628,000 Ukrainian records

A Russian-speaking initial access broker tracked as CyberXero used an orchestration layer built on Anthropic's Claude Code to automate attacks against WordPress and e-commerce sites worldwide and to probe Ukrainian energy and critical infrastructure, according to research by threat intelligence firm SOCRadar reported by The Hacker News on October 12. SOCRadar confirmed data theft from four Ukrainian organizations involving more than 628,000 records tied to Ukrainian individuals, and said the campaign was still ongoing at the time of reporting.

What happened

According to The Hacker News, SOCRadar describes CyberXero as financially motivated and active since at least July 2026. The researchers uncovered the operation after finding an exposed open directory that leaked the actor's live working directory, including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, agent configurations and stolen data.

The actor ran two pipelines. An opportunistic, automated pipeline targeted WordPress and e-commerce platforms for access and payment data, exploiting the wp2shell flaws CVE-2026-63030 and CVE-2026-60137, the Support Board plugin SQL injection CVE-2026-4815, and exposed Redis servers. A second, manual pipeline focused on deep reconnaissance of Ukrainian energy and critical infrastructure, including a heating provider in Kharkiv; SOCRadar noted no obvious path to direct monetization for that activity. Other confirmed compromises were found in Poland, China and the Netherlands.

Technical details

The Hacker News reported that Claude Code ran on the attacker's main workstation and coordinated a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance and post-exploitation. In one automated run, 4,708 targets were scanned, 429 WordPress admin panels were accessed and 32 web shells were deployed within 61 seconds. The open-source autonomous pentesting agent PentAGI was also connected to a Cobalt Strike team server.

When an agent refused a request, the actor reset the session and preloaded an "authorized pentest" framing, SOCRadar said. The logs also show refusals that held: across four iterations, the model declined to install a backdoor, disable a firewall, move laterally or deploy a web shell, and rejected a forged ownership token. The Hacker News did not include a response from Anthropic.

In a separate report, SOCRadar described "Operation Master," in which an actor using the alias "masterblack" allegedly relied heavily on Claude-based agents to write intrusion code and fed stolen data into an invoice fraud platform that sent more than 2.4 million messages to Brazilian targets.

What to do

SOCRadar advises operators of WordPress, Magento, PrestaShop and internet-exposed Redis to:

• Check for unexpected WordPress administrator accounts.
• Look for WSO web shells on web servers.
• Review ~/.ssh/authorized_keys on Redis hosts for unknown entries, and avoid exposing Redis to the internet.
• Patch the WordPress and plugin flaws named in the report.