CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
Summary
Cybersecurity researchers have identified a new AI-augmented campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. This campaign, dubbed CyberXero, uses commodity offensive tools like Cobalt Strike combined with an AI orchestration layer powered by Anthropic's Claude Code. The campaign has already succeeded in stealing over 628,000 Ukrainian records.
IFF Assessment
The campaign's success in stealing sensitive data and its sophisticated use of AI for offensive purposes pose a significant threat to defenders.
Defender Context
This campaign highlights the growing threat of AI-powered attacks, where actors combine readily available offensive tools with advanced AI models to achieve greater efficiency and impact. Defenders should be aware of the increasing sophistication of threat actors who can leverage AI for initial access and data exfiltration.