Published 12 October 2026 · Updated 19 October 2026
I have been writing about AI-powered cyberattacks for long enough to know the difference between theoretical warnings and real-world weaponisation. The CyberXero campaign is the latter.
What we have here is a Russian-speaking initial access broker codenamed CyberXero, SOCRadar published the details on 6 October after discovering an unsecured directory on the attacker’s server that exposed scripts, stolen data, AI session logs and configurations. This was not a simulation. It was a live operation, caught mid-stride.
The headline figure is more than 628,000 stolen Ukrainian records, taken from four confirmed victim organisations. But the numbers that matter more are these: 51 specialised Claude Code agents running on the attacker’s primary workstation. One automated run that scanned 4,708 targets, found 429 WordPress admin panels, and deployed 32 web shells in 61 seconds. That is not a typo. Sixty-one seconds.
CyberXero runs two parallel pipelines. The first is a global automated spray against WordPress and e-commerce platforms anywhere in the world. The second is a curated manual campaign targeting Ukrainian energy and critical infrastructure providers. One specific target a district heating provider in Kharkiv had 564,073 subscriber records siphoned along with 213,340 access-log entries. Names, addresses, account numbers, timestamps, IP addresses. The kind of data that gives an attacker a permanent foothold in someone’s life.
The AI setup matters here. CyberXero was not just using ChatGPT to write phishing emails. They deployed two independent AI layers: Claude Code with a cluster of 51 specialised agents for scanning, exploit chaining, reconnaissance and post-exploitation, plus PentAGI an open-source self-hosted AI agent for fully autonomous penetration testing connected directly to Cobalt Strike through an AI provider API for payload generation. That is two entirely different AI toolchains working in parallel.
And CyberXero is not alone. Microsoft’s 2026 Digital Defense Report warns that the median time from vulnerability discovery to weaponisation has dropped to well below 24 hours. The number of CVEs tracked for 2026 is on track for a record 72,000. Phishing as an initial attack vector jumped from 7% of intrusions to 23% in a single year because AI lets attackers personalise every message at scale.
For anyone running a WordPress site this campaign should be especially unsettling. According to SOCRadar’s findings, the CyberXero playbook relies on known WordPress plugin vulnerabilities rather than zero-days. They are using flaws that already have patches. The problem is those patches are not being applied fast enough.
What does this mean for the average person? It means the gap between AI on the defender side and AI on the attacker side is widening, and the attackers are winning. We are past the point where “we will detect it in time” is a viable strategy. The attackers’ timeline is measured in seconds. Yours needs to match.
Patch your WordPress plugins. Turn on Web Application Firewall rules if your host provides them. Audit every exposed admin panel. And assume that if you have a WordPress site with an unpatched plugin, CyberXero or someone like them has already scanned it.
Sources
- eSecurity Planet, CyberXero uses Claude Code in Ukraine data theft. October 2026. Reporting on SOCRadar’s investigation
- Security Affairs, CyberXero used 51 AI agents to steal 628,000 Ukrainian records. October 2026
- GBHackers, Russian-speaking CyberXero uses AI agent swarm to attack Ukrainian energy infrastructure
- Help Net Security, AI is giving attackers a head start, Microsoft warns. Reporting on Microsoft’s 2026 Digital Defense Report
Campaign figures come from SOCRadar’s investigation as reported by the outlets above. Advice for WordPress site owners is the author’s guidance.
Related Reading
- Anthropic Reveals Russian Hackers Are Using AI to Automate Malware Attacks
- For $3,000 and a Few Days, Researchers Used Claude to Hack OpenAI’s Infrastructure
- The AI Agents That Escaped and Hacked Real Companies: A Timeline
CyberXero’s 32 web shells deployed in 61 seconds is the fastest automated breach I have seen documented. The defenders’ window of response has collapsed to nearly zero. Plan accordingly.
How this analysis is researched, sourced and corrected: Editorial standards and corrections. Spotted an error? Contact Philip Hall.
