Executive Summary
A campaign attributed to CyberXero combined commodity tools like Cobalt Strike with an AI orchestration layer built on Anthropic's Claude Code to gain access to WordPress sites, e-commerce platforms and critical infrastructure in Ukraine, stealing over 628,000 records.
What Happened
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed
Affected Products
- Claude Code
- WordPress
Vulnerability / Attack Technique
AI-orchestrated initial access campaign
Technical Mechanism
Attackers used Claude Code as an orchestration layer driving commodity offensive tooling such as Cobalt Strike to compromise targets and steal records.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
Relevant Frameworks
RealGround Analysis
Coding agents are now part of attacker toolchains, coordinating existing tools at scale. RealGround analysis: defenders should expect faster, broader commodity intrusion campaigns against web platforms.
Recommended Controls
- Patch and harden WordPress and e-commerce platforms
- Detect Cobalt Strike and similar post-exploitation tooling
- Rate-limit and monitor automated scanning against web properties
Related RealGround Service
AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/cyberxero-uses-claude-code-in-campaign.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.