CyberXero Uses Claude Code to Breach WordPress Sites

The CyberXero group used Anthropic's coding agent Claude Code to coordinate attacks on WordPress sites. It worked with flaws that were already public and with common tools such as Cobalt Strike. It did without zero-days and without a model of its own.

The campaign is ongoing. SOCRadar described it in a report^[1] published last week. The Hacker News reports on October 12, 2026^[2] that four Ukrainian organizations were robbed and more than 628,000 records belonging to Ukrainian citizens were stolen.

An exposed folder revealed the operation

SOCRadar found a folder on a server that was open to anyone. It was the attacker's working folder, tied to a Linux workstation.

Inside were the following materials.

• The logs of the sessions with the artificial intelligence.
• Scripts with access tokens written in plain text.
• Kits for exploiting the flaws.
• The results of the reconnaissance.
• The configurations of the AI agents.
• Data stolen from the victims.

The researchers attribute the operation to a financially motivated, Russian-speaking group. It is an initial access broker, meaning a group that breaches systems in order to resell the access. It is believed to have been active since at least July 2026.

The operation follows two tracks in parallel.

• Global track: automated attacks on WordPress sites and e-commerce platforms, to obtain access and payment data.
• Ukrainian track: deep reconnaissance and manual attacks against energy and public services, including a heating provider in Kharkiv.

SOCRadar confirms further breaches in Poland, China and the Netherlands.

Three known flaws and 61 seconds for 32 web shells

The global track takes control of WordPress sites with three already catalogued flaws.

• CVE-2026-63030 and CVE-2026-60137, the pair known as wp2shell.
• CVE-2026-4815, a SQL injection in the Support Board plugin for WordPress.

The exposed folder documents a single automated run. That run examined 4,708 targets and confirmed access to 429 WordPress admin panels^[2]. It then installed 32 web shells in 61 seconds.

A web shell is a program that gives remote control of the site.

The infrastructure comprises eight distinct nodes. Among them are the attacker's Linux workstation, a staging server, the servers hosting the malicious programs and a scanner that selects the targets. One node is used to turn access into money.

According to the report, CyberXero employed artificial intelligence in two independent phases of the attack. Claude Code acts as a coordination layer on top of the common tools.

The account consulted is silent on the patched versions of the affected components. Those who run these sites will find the status of the fixes in each vendor's security advisory.

The agent is the attack tool, the flaw lies elsewhere

The report describes an abuse of Claude Code. The text is silent on any defect in the agent's code.

The exploited flaws are in WordPress and its plugins.

What remains open is the question of control over the offensive use of commercial coding agents. The material consulted is silent on Anthropic's response.

What to check in your organization this week

1. Which of the company's WordPress sites use Support Board or the components affected by wp2shell?
2. How much time passes between a new file appearing on the web server and the alert?
3. What does the contract with the coding agent vendor provide against offensive use?

The benchmark for the second question is the minute measured by SOCRadar.

From checks to actions

These are the actions that follow from the documented facts.

• Apply the fixes indicated by the vendors for the three CVEs cited.
• Search for web shells on WordPress sites whose admin panel is reachable from the internet.
• Restrict access to the admin panel to known addresses.
• Give every internal coding agent its own credentials and logs that are read by a person.
• Include in contracts with agent vendors an obligation to report the abuses they detect.

The procurement committee has one more criterion for evaluating a coding agent. What counts is how well the vendor can see and stop offensive use of its own product.