CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

CyberXero, a Russian-speaking threat actor, has used Anthropic's Claude Code AI to orchestrate a large-scale cyber campaign since July 2026, compromising WordPress sites and Ukrainian critical infrastructure, stealing over 628,000 records. The campaign combines automated global attacks on e-commerce platforms with targeted manual attacks on Ukrainian energy entities, exploiting known vulnerabilities and deploying web shells rapidly.