AI-Assisted CyberXero Campaign Compromised Ukrainian Systems and Stole 628,000 Records
Researchers have detailed an AI-augmented initial access operation attributed to CyberXero that targeted WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. The campaign combined common offensive tools such as Cobalt Strike with an orchestration layer built on Anthropic's Claude Code. It resulted in the theft of more than 628,000 Ukrainian records.
Researchers have described an intrusion campaign tied to CyberXero as assisted by artificial intelligence. It sought initial access to Ukrainian WordPress sites, online shops, and critical infrastructure. The operation reportedly merged familiar offensive tools, including Cobalt Strike, with a coordination layer based on Anthropic's Claude Code. More than 628,000 Ukrainian records were taken, and Ukrainian systems were compromised.
The reported theft could affect Ukrainian individuals and organizations whose records were exposed, potentially increasing risks of fraud, account takeover, or operational disruption. Because targets included e-commerce and critical infrastructure, downstream effects may extend to customers, partners, and public services. The use of AI-assisted orchestration may also encourage defenders to reassess detection and response for automated intrusion workflows.