AI‑Powered CyberXero Attack Harvests Hundreds of Thousands of Ukrainian Records

Cybersecurity analysts have uncovered a sophisticated initial‑access operation that leveraged artificial‑intelligence tools to compromise WordPress sites, e‑commerce platforms and a range of critical‑infrastructure services across Ukraine, ultimately exfiltrating more than 628,000 personal records.

The campaign, dubbed CyberXero by researchers, unfolded in two distinct phases. First, automated scans identified vulnerable WordPress installations and poorly secured e‑commerce storefronts. Once a foothold was gained, the attackers deployed a second wave of AI‑generated scripts to move laterally within networks and extract data from high‑value systems that support utilities and other essential services.

Central to the operation was the use of code produced by Claude, an advanced language model developed by Anthropic. The threat actors fed the model specific prompts to create custom exploit code, obfuscation routines and data‑exfiltration modules, dramatically shortening the development cycle compared with traditional manual coding. This approach illustrates a growing trend where commodity AI services are weaponized to automate complex hacking techniques.

According to the disclosed findings, the exfiltrated dataset contained personal identifiers, contact details and, in some cases, financial information belonging to Ukrainian citizens and entities. The sheer volume—over six hundred thousand records—highlights the campaign’s scale and the potential for downstream abuse, including phishing, identity theft and further intrusion attempts against related organizations.

Experts note that the blend of AI assistance and widely used platforms like WordPress creates a potent attack surface. WordPress powers an estimated 40 percent of all websites, and many installations run outdated plugins or default credentials, making them attractive entry points. Coupled with the geopolitical focus on Ukraine’s critical infrastructure, the operation underscores how state‑linked or opportunistic actors can exploit both technical and political vulnerabilities.

In response, security teams are urged to harden WordPress deployments, enforce strict credential hygiene, and monitor for anomalous AI‑generated code patterns. Researchers continue to track the threat group’s infrastructure, and law‑enforcement agencies are reportedly collaborating with international partners to attribute the actors behind CyberXero. The incident serves as a stark reminder that AI, while a powerful productivity tool, is increasingly a double‑edged sword in the cyber‑threat landscape.