CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have uncovered a two-pronged AI-augmented campaign by threat actor CyberXero targeting WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. The campaign combines commodity offensive tools such as Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code. The operation resulted in the theft of over 628,000 Ukrainian records. The use of Claude Code as an AI orchestration layer represents a novel and concerning escalation in threat actor capabilities. This campaign highlights the growing trend of adversaries integrating commercial AI tools into their offensive operations to enhance effectiveness and automation of attacks.