Researchers at SOCRadar have detailed an AI-augmented initial access campaign attributed to a Russian-speaking, financially motivated broker tracked as CyberXero. Active since at least July 2026, the operation runs two pipelines: a global automated campaign against WordPress and e-commerce platforms, and a curated manual campaign against Ukrainian energy and critical infrastructure, including a heating provider in Kharkiv. The campaign has led to confirmed exfiltration from four Ukrainian organizations, with more than 628,000 records tied to Ukrainian individuals, plus compromises in Poland, China, and the Netherlands.
SOCRadar said it discovered the operation after finding an exposed open directory that leaked the attacker's live working directory, including AI session logs, scripts with plaintext tokens, and exfiltrated data. The attack architecture uses eight nodes, and AI appears in two stages: Claude Code runs a cluster of 51 specialized agents for scanning, exploit chaining, reconnaissance, and post-exploitation, while PentAGI, an open-source autonomous pentesting agent, is connected to Cobalt Strike through an AI provider API for payload generation and execution. In one automated run, the scanner checked 4,708 targets, confirmed access to 429 WordPress admin panels, and deployed 32 web shells in 61 seconds.
The leaked logs also show how the actor tried to get around model refusals: by using context engineering and session resets, often claiming an 'authorized pentest on my own infrastructure.' SOCRadar notes that safety controls act on session context, not model weights, so a refusal in one session does not carry into the next. At the same time, the logs record genuine refusals that held, including declines to install a backdoor, disable a firewall, move laterally, and deploy a web shell. The campaign remains ongoing; organizations running WordPress, Magento, PrestaShop, or exposed Redis are advised to look for rogue administrators, WSO web shells, and unexpected entries in ~/.ssh/authorized_keys.