AI-Augmented Campaign Cyberxero Steals Over 628,000 Ukrainian Records

Researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, attributed to the threat actor Cyberxero, brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code. The campaign has been active during October 2026 and has resulted in the theft of over 628,000 Ukrainian records. The attackers leveraged AI-assisted techniques to facilitate initial access, combining known offensive tooling with an orchestration layer derived from Anthropic's Claude Code product. The scope of the compromise includes WordPress installations, e-commerce platforms, and critical infrastructure entities within Ukraine. Security researchers note that the integration of AI into the attack chain represents a growing trend in threat actor tooling, though specific details of the Claude Code integration with Cobalt Strike remain subject to verification. The publication of the findings by The Hacker News highlights the increasing intersection of AI capabilities and traditional cyber offensive frameworks.