AI-Powered CyberXero Campaign Steals 628,000 Ukrainian Records

A Russian-speaking threat actor, CyberXero, has executed a dual campaign targeting WordPress, e-commerce, and Ukrainian critical infrastructure. The campaign combines commodity tools like Cobalt Strike with AI orchestration using Anthropic’s Claude Code. One pipeline targets WordPress vulnerabilities to harvest payment data, while the other focuses on deep reconnaissance of Ukrainian energy and utilities. The attack resulted in the confirmed exfiltration of over 628,000 records from Ukrainian organizations, with additional breaches in Poland, China, and the Netherlands. The operation was exposed through an open directory leak, revealing AI session logs, exploitation toolkits, and exfiltrated data. CyberXero used AI agents for scanning, exploit chaining, and post-exploitation, bypassing model refusals through session-reset techniques.