CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have revealed a campaign targeting Ukrainian WordPress sites, e-commerce platforms, and critical infrastructure entities. The campaign, which combines commodity tools like Cobalt Strike with an AI orchestration layer using Claude Code, has resulted in the theft of over 628,000 Ukrainian records. The attack is a two-pronged artificial intelligence-augmented initial access campaign. The campaign's activity has been attributed, although the specific attribution details are not provided. The use of AI augmentation is a notable aspect of the campaign. The attackers leveraged Anthropic's Claude Code to power the AI orchestration layer.