CyberXero: an access broker that runs its intrusions through AI agents

A financially motivated, Russian-speaking initial access broker tracked as CyberXero has been running two campaigns at once: a fully automated sweep of WordPress and e-commerce sites worldwide, and a slower, hand-guided operation against Ukrainian energy and utility providers. Researchers say the operator used AI coding agents, including Anthropic's Claude Code, as the orchestration layer that ties the two together. They link the campaign to more than 628,000 records belonging to Ukrainian individuals.

What happened

The operation came to light because the attacker left their own working directory open. A misconfigured server exposed the actor's live workspace: AI session logs, agent configurations, scripts with hard-coded tokens, reconnaissance output, exploitation kits and stolen data. Researchers assess that the actor has been active since at least July 2026 and that the campaign is still running.

What the exposed material shows:

• Opportunistic pipeline (global). Mass scanning of WordPress, Magento and PrestaShop sites, followed by exploitation of known plugin flaws, including wp2shell (CVE-2026-63030 / CVE-2026-60137) and an SQL injection in the Support Board plugin (CVE-2026-4815). On the compromised sites the actor planted web shells and created rogue administrator accounts. The goal is to sell access and steal payment data. One recorded run scanned 4,708 targets, confirmed 429 WordPress admin panels and deployed 32 web shells in about a minute.
• Directed pipeline (Ukraine). AI-assisted reconnaissance of around 95 domains and seven energy entities, including a heating provider in Kharkiv. Access came through blind SQL injection, exposed database admin tools and Magento CVEs. Data was confirmed stolen from four Ukrainian organisations. This pipeline has no obvious way to make money, so researchers say the data may have geopolitical value or be resold.
• Spill-over. Researchers also confirmed compromises in Poland, the Netherlands and China, where internet-exposed Redis servers were abused.
• The AI layer. The workstation hosted a cluster of about 51 specialised Claude Code agents for scanning, exploit chaining and post-exploitation. Separately, an open-source autonomous pentest agent (PentAGI) was wired into a Cobalt Strike team server.

Researchers describe the gang as a criminal operation, not a confirmed state-sponsored campaign, and the attribution should be read with that caveat.

The "authorized pentest" problem

The most instructive detail is how the operator got around AI safety controls. They told the agents they were running an authorized penetration test on their own infrastructure. When an agent refused, the operator opened a fresh session with that framing preloaded and tried again. The safeguards did not always give way, though. The logs show the model repeatedly refusing to install a backdoor, disable a firewall, move laterally or deploy a web shell, and it rejected a forged proof-of-ownership token.

The same researchers describe a separate actor, "masterblack" (Operation Master), who used the same framing. That actor exploited Palo Alto GlobalProtect gateways (CVE-2026-0257), GitLab (CVE-2023-7028) and Dompdf (CVE-2022-28368), and ran an invoice-fraud platform aimed at Brazilian consumers. Recovered transcripts show offensive work being presented as bug-bounty or pentest activity.

Why it matters

• AI speeds up attackers more than it changes how they attack. The bugs were known and the tools were off the shelf. The new part is the pace: thousands of targets triaged and dozens of footholds planted in minutes. The time between a flaw being disclosed and your site being scanned for it keeps shrinking.
• Typing "authorized" proves nothing. Any workflow that trusts a claim of permission without checking it independently can be abused. That applies to AI tools and to human processes alike. Real ownership proof, such as a DNS challenge or a signed scope document, is what separates legitimate testing from abuse.
• Critical infrastructure is still being targeted. Ukrainian energy and utility operators were deliberately picked out and studied, and their suppliers and partners in the region are exposed too.

What to do

1. Patch WordPress, Magento and PrestaShop fast, especially plugins, and remove the ones you don't use. Prioritise the CVEs listed above.
2. Hunt for indicators of this activity: unknown WordPress administrators, WSO or other web shells (unexpected PHP files in upload and plugin folders), and unexpected entries in ~/.ssh/authorized_keys on Redis hosts.
3. Take Redis and database admin tools off the internet. Require authentication on Redis and never expose Adminer or phpMyAdmin publicly.
4. Patch edge devices (GlobalProtect, SonicWall, Fortinet, Exchange) and watch for device-code phishing and password spraying against Microsoft 365.
5. Rate-limit and monitor admin login pages, and put a WAF in front of public CMS sites to slow automated SQL injection and brute force.
6. Govern your own AI agents. Check scope against independent proof of ownership, log what agents do, and keep a human approving every active step.

At 4Tify we assess exactly this exposed surface: outdated CMS plugins, exposed admin panels and services, and known CVEs on your public stack. We do it only on assets whose ownership has been verified, and an analyst reviews every result.

Based on research by SOCRadar, as reported by The Hacker News.