CyberXero Conducts Large-Scale Data Theft Campaign Using Claude Code

Researchers have uncovered a sophisticated cyber campaign in which a financially motivated threat actor known as CyberXero combined automated exploitation frameworks with artificial intelligence to compromise WordPress sites, online commerce platforms, and organizations operating within Ukraine's critical infrastructure sector.

According to investigators, the Russian-speaking initial access broker has been active since at least July 2026 and operates two parallel attack tracks. One is a highly automated, global campaign targeting vulnerable WordPress and e-commerce environments for scale and monetization. The second is a far more selective operation focused on Ukrainian energy providers and critical infrastructure organizations, where attacks involve extensive reconnaissance and hands-on exploitation.

The broader campaign abuses publicly known vulnerabilities, including wp2shell flaws (CVE-2026-63030 and CVE-2026-60137) as well as CVE-2026-4815, a SQL injection vulnerability affecting the Support Board WordPress plugin. Successful exploitation enables attackers to gain administrative control over websites and establish persistent access.

Researchers estimate that the operation has already led to data theft from at least four Ukrainian organizations, resulting in the compromise of more than 628,000 records belonging to Ukrainian citizens. Additional victims have been identified in Poland, China, and the Netherlands, highlighting the campaign's international reach.

The investigation began after analysts discovered an exposed directory hosted on a publicly accessible server that inadvertently revealed the threat actor's operational workspace. The exposed environment contained AI conversation logs, offensive tooling, reconnaissance results, plaintext authentication tokens, agent configurations, exploitation scripts, and stolen victim data, offering rare insight into the group's infrastructure and methods. Evidence suggests the activity remains ongoing.

Two Distinct Attack Pipelines

The first campaign focuses on maximizing access opportunities across WordPress and e-commerce environments, where stolen credentials and payment information can be directly monetized.

The second campaign is more deliberate and intelligence-driven, targeting Ukrainian utilities and energy-sector organizations, including a heating service provider located in Kharkiv. Rather than seeking quick financial returns, these intrusions emphasize network mapping, intelligence collection, and manual compromise efforts.

Analysis of the leaked infrastructure revealed the scale of the automation involved. During one execution cycle, CyberXero scanned 4,708 potential targets, successfully identified access to 429 WordPress administrative portals, and deployed 32 web shells in just over one minute, demonstrating a highly streamlined attack workflow.

AI Embedded Throughout the Intrusion Lifecycle

Investigators found that CyberXero integrated artificial intelligence into multiple stages of its operations.

The group's primary workstation reportedly ran Claude Code, supported by a network of 51 specialized AI agents tasked with activities such as:

• Vulnerability scanning
• Target identification
• Exploit chaining
• Reconnaissance automation
• Post-exploitation support

In a separate workflow, the operator connected PentAGI (Penetration Testing Artificial General Intelligence), an open-source autonomous penetration testing platform, to Cobalt Strike infrastructure through an AI-provider API. This arrangement enabled automated payload creation, testing activities, and portions of intrusion execution.

Researchers observed repeated attempts to bypass AI safety restrictions by framing offensive actions as authorized security assessments. When requests were rejected, the operator frequently restarted sessions and reintroduced context claiming the activities were part of a legitimate penetration test. While some tasks were accepted, logs also revealed instances where AI systems consistently refused requests involving backdoor installation, firewall tampering, lateral movement, or web shell deployment.

Expansion Beyond WordPress

The activity was not limited to web applications. CyberXero also exploited internet-exposed Redis instances, leading to successful compromises of at least two organizations in China.

Organizations operating:

• WordPress
• Magento
• PrestaShop
• Publicly accessible Redis servers

are advised to review systems for indicators of compromise such as unauthorized administrator accounts, WSO web shells, unexpected SSH authorized key entries, and unauthorized persistence mechanisms.

Researchers noted a clear distinction between the two operational tracks. The large-scale automated campaign appears motivated by access brokerage and financial gain through payment data theft, while the targeted attacks against Ukrainian infrastructure exhibit characteristics more commonly associated with strategic reconnaissance and long-term intelligence gathering.

Operation Master: Industrialized Intrusions and Financial Fraud

In a separate investigation, researchers analyzed a cybercrime ecosystem dubbed Operation Master, which combines enterprise compromises, large-scale data theft, underground data sales, and automated invoice fraud operations.

The campaign is linked to a threat actor operating under the online alias masterblack, who has conducted multiple attack waves between April and September 2026.

Observed activities included:

• Mass scanning of Palo Alto Networks PAN-OS GlobalProtect gateways and exploitation of CVE-2026-0257
• Targeting of SonicWall SMA, Fortinet, Keycloak, Microsoft Exchange, and Next.js on IIS environments
• Collection of public developer resources, banking API documentation, energy-sector schemas, and software packages for reconnaissance purposes
• Automated SQL injection campaigns against Brazilian SaaS, CRM, education, support, and financial platforms
• SQL injection attacks against ASP.NET applications through __VIEWSTATE manipulation targeting over twenty financial institutions
• Exploitation of CVE-2022-28368 affecting Dompdf
• Device-code phishing and password-spraying attacks against Microsoft 365 tenants
• Exploitation of GitLab CVE-2023-7028 to target energy-sector organizations
• Credential brute-forcing campaigns against WordPress environments belonging to Japanese enterprises
• Privilege escalation using tools such as GodPotato, Kerberoast, AS-REP Roasting, and Evil-WinRM
• Use of PwnKit (CVE-2021-4034), CVE-2024-1086, and Ghostcat (CVE-2020-1938) for privilege escalation and lateral movement
• Data theft through DNS tunneling, rclone, SFTP, and other covert transfer methods
• Deployment of the AdaptixC2 command-and-control framework

Massive Invoice Fraud Infrastructure

One of the most notable components of Operation Master was an industrial-scale invoice fraud platform targeting Brazilian consumers and businesses.

Before disappearing offline in mid-September, the infrastructure generated:

• More than 2.4 million email, SMS, and WhatsApp messages
• 622,666 personalized invoice links
• 169,906 recorded victim interactions

Investigators estimate the operation may have exposed victims to approximately R$38.9 million in fraudulent payment requests, while all tracked invoice links represented a cumulative value exceeding R$150 million.

The fraud scheme primarily sought to trick recipients into making payments through Brazil's Pix instant payment system.

AI-Assisted Cybercrime at Scale

Researchers believe masterblack, much like CyberXero, heavily relied on Claude-powered AI agents for generating intrusion tooling, exploit code, and data-exfiltration scripts while manually developing fraud portals and custom AdaptixC2 extensions.

Recovered logs showed repeated efforts to disguise offensive development requests as authorized bug-bounty work or legitimate penetration-testing activities. These prompts frequently sought functionality that closely matched malicious behaviors later observed throughout the operation.

The findings illustrate a growing trend in which threat actors are using AI not merely as a productivity aid but as a force multiplier, enabling faster exploit development, automated reconnaissance, scalable intrusion workflows, and industrialized cybercrime operations across multiple sectors and regions.