CyberXero Uses Claude Code and AI Agents to Automate Exploitation at Scale
CyberXero Uses Claude Code and AI Agents to Automate Exploitation at Scale
A threat actor called CyberXero has been documented running two simultaneous attack pipelines: an automated global campaign against WordPress and e-commerce platforms, and a targeted manual campaign against Ukrainian critical infrastructure. The operation uses Claude Code with 51 specialized agents to drive scanning, exploit chaining, and post-exploitation. Security and endpoint teams need to map their detection coverage against this AI-augmented initial access pattern now.
SOCRadar has published a report documenting an active, ongoing campaign by a financially motivated initial access broker codenamed CyberXero, assessed to be active since at least July 2026.
The operation combines commodity offensive tooling with an AI orchestration layer:
- Claude Code runs on the attacker's primary Linux workstation, directing a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation.
- PentAGI, an open-source self-hosted AI penetration testing agent, is connected to a Cobalt Strike Team Server via an AI provider API for payload generation and pentest execution.
- To bypass model safety refusals, the actor uses context-engineering and session-reset techniques, framing requests as authorized pentests. The source notes that model safety controls apply per session, not to model weights, so a refusal in one session does not persist into a new one.
The architecture spans eight nodes: the attacker's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanner.
The global automated pipeline targets known vulnerabilities:
- CVE-2026-63030 and CVE-2026-60137 (wp2shell)
- CVE-2026-4815 (SQL injection in the Support Board WordPress plugin)
- Exposed Redis servers
The targeted pipeline focuses on Ukrainian energy and utility organizations, including a heating provider in Kharkiv, using deep reconnaissance and manual exploitation.
The campaign is documented to have exfiltrated more than 628,000 records from four Ukrainian organizations. Confirmed compromises also occurred in Poland, China, and the Netherlands. A single automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels, and deployed 32 web shells in a 61-second window.
SOCRadar discovered the operation through an exposed open directory on IP 46.21.250[.]135, which leaked the attacker's live working directory including AI session logs, scripts with plaintext tokens, exploitation toolkits, reconnaissance output, AI agent configurations, and exfiltrated victim data.
The source identifies the following affected environments:
- WordPress sites (global, automated)
- Magento and PrestaShop e-commerce platforms (global, automated)
- Ukrainian energy and critical infrastructure organizations (targeted, manual)
- Organizations exposing Redis servers to the internet
Confirmed victim geographies: Ukraine, Poland, China, Netherlands. The source does not specify which Microsoft products or services are directly in scope for this campaign.
The source states the campaign has been active since at least July 2026 and remains ongoing as of the report published last week (relative to the article dated October 12, 2026).
- Check WordPress environments for rogue administrator accounts (source-stated indicator)
- Check for WSO web shells on WordPress, Magento, and PrestaShop hosts (source-stated indicator)
- Check Redis hosts for unexpected entries in
~/.ssh/authorized_keys(source-stated indicator) - Verify Redis is not exposed to the internet; if it is, treat it as a priority remediation
- Confirm patching status for CVE-2026-63030, CVE-2026-60137 (wp2shell), and CVE-2026-4815 (Support Board plugin) on any WordPress estate
- Review Cobalt Strike and web shell detection rules in your EDR and SIEM against the documented 61-second deployment window, that speed compresses the detection window significantly
- If your environment runs AI coding agents (Claude Code or similar) in any capacity, review whether session context controls and token handling could expose working directories or plaintext credentials, as the attacker's own exposed directory was the source of discovery here
My read is that the operationally significant detail here is speed: 32 web shells deployed in 61 seconds is faster than most alert triage cycles. AI orchestration is not changing the vulnerability surface, but it is compressing the time between access and persistence to a point where reactive detection alone is insufficient. The session-reset technique used to work around model refusals is also notable: it means safety guardrails in AI coding tools are not a reliable barrier against misuse at the operator level, only a friction point.
I would prioritize this for endpoint and identity teams running WordPress or e-commerce infrastructure, and for any team responsible for critical infrastructure adjacent to the Ukrainian conflict zone. The detection gap to model is the 61-second web shell deployment window. Check whether your current alert pipeline can surface web shell creation and new WordPress admin accounts within that window. I would also flag the plaintext token leak from the attacker's own directory as a reminder to audit how AI coding agent sessions are stored and whether working directories are accessible from internet-facing infrastructure.
The source is a The Hacker News article dated October 12, 2026, summarizing a SOCRadar report; the original SOCRadar report is referenced but not supplied, so specific IoC lists, full MITRE mappings, and detailed technical appendices are not available from the supplied text.