CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

The CyberXero campaign demonstrates how threat actors are weaponizing AI orchestration tools like Claude Code to dramatically accelerate and scale attacks against poorly secured web platforms, including WordPress sites and e-commerce infrastructure. By combining commodity tools such as Cobalt Strike with AI-driven automation, attackers can identify and exploit misconfigurations and unpatched vulnerabilities at machine speed, reducing the window defenders have to respond. The scale of 628,000 stolen records underscores the catastrophic impact of inadequate vulnerability management and weak configuration hardening on public-facing systems. This matters because AI augmentation lowers the skill barrier for sophisticated campaigns, meaning even moderately resourced threat actors can now execute operations that previously required nation-state-level expertise.