CyberXero used Claude Code to steal 628,000 Ukrainian records

Researchers disclosed a two-pronged AI-augmented initial access campaign targeting WordPress sites, e-commerce platforms and critical infrastructure in Ukraine. The activity combined Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code and resulted in over 628,000 stolen records.

• CyberXero campaign paired Cobalt Strike with a Claude Code AI layer
• Targets included WordPress sites, e-commerce and Ukrainian critical infrastructure
• More than 628,000 Ukrainian records were stolen