Cybersecurity researchers have uncovered two cybercrime operations using artificial intelligence (AI) to automate attacks, compromise enterprise networks, steal sensitive data, and support financial fraud.
One campaign, attributed to a Russian-speaking threat actor known as CyberXero, targets WordPress websites, e-commerce platforms, and Ukrainian critical infrastructure using AI agents alongside conventional hacking tools.
According to a report from SOCRadar, CyberXero has been active since at least July 2026 and operates two parallel attack campaigns. One focuses on automated attacks against WordPress and e-commerce platforms worldwide, while the other involves targeted reconnaissance and manual exploitation of energy and critical infrastructure organizations in Ukraine.
The global campaign exploits known security vulnerabilities, including wp2shell flaws tracked as CVE-2026-63030 and CVE-2026-60137, along with CVE-2026-4815, an SQL injection vulnerability affecting the Support Board WordPress plugin. The attackers use these weaknesses to gain unauthorized access to websites and potentially obtain payment information and other sensitive data.
Researchers confirmed that the operation resulted in data theft from four Ukrainian organizations, exposing more than 628,000 records associated with Ukrainian individuals. Additional compromises were identified in Poland, China, and the Netherlands. The campaign remains active.
SOCRadar discovered the operation after finding an exposed directory hosted at 46.21.250[.]135. The directory revealed the attacker’s working files from a Linux workstation, including AI session logs, scripts containing plaintext tokens, exploitation tools, reconnaissance results, AI agent configurations, and stolen victim data.
The exposed files provided insight into the scale of the campaign. During a single automated execution, the attacker scanned 4,708 targets and confirmed access to 429 WordPress administration panels. The operation then deployed 32 web shells within just 61 seconds.
The attack infrastructure consists of eight distinct nodes, including the attacker’s Linux workstation, a provisioning server, monetization infrastructure, payload staging servers, and a scanning system used to identify potential targets.
A central part of the operation is the use of AI-powered tools at different stages of the attack. CyberXero reportedly uses Anthropic’s Claude Code with a group of 51 specialized agents to handle scanning, exploit chaining, reconnaissance, and post-exploitation activities. This setup runs on the attacker’s primary workstation.
The threat actor also connected PentAGI, an open-source, self-hosted AI agent designed for autonomous penetration testing, to the Cobalt Strike framework through an AI provider API. This integration supports payload generation and penetration-testing tasks and operates through a Cobalt Strike Team Server.
Researchers also found evidence that the attacker attempted to work around AI safety restrictions by manipulating session context. When an AI agent refused a request, the operator sometimes opened a new session and described the activity as an authorized penetration test against their own infrastructure.
However, the recovered logs also contained refusals that remained in place. Across four attempts, the AI model declined requests to install a backdoor, disable a firewall, move laterally through a network, and deploy a web shell. In another incident, it refused a scanning request four consecutive times and correctly rejected a forged ownership token.
Beyond WordPress and e-commerce platforms, CyberXero also targeted exposed Redis servers. These attacks reportedly resulted in the compromise of two Chinese entities. Organizations using WordPress, Magento, or PrestaShop, as well as those exposing Redis services to the internet, have been advised to investigate suspicious WordPress administrator accounts, unauthorized WSO web shells, and unexpected entries in the ~/.ssh/authorized_keys file on Redis hosts.
SOCRadar described the operation as a combination of large-scale automated attacks aimed at obtaining access to websites and stealing payment information, and more selective intrusions targeting Ukrainian critical infrastructure. The latter activity includes reconnaissance and manual exploitation of energy and utility organizations, including a heating provider in Kharkiv.
In a separate report, SOCRadar also detailed another cybercrime operation dubbed Operation Master, which focuses on compromising enterprise networks, stealing customer and billing databases, selling stolen information through underground forums, and using the data to support an automated invoice-fraud platform.
The operator, known by the online alias masterblack, conducted multiple attack campaigns between April and mid-September 2026. The activity included mass scanning of Palo Alto Networks PAN-OS GlobalProtect gateways and exploitation of CVE-2026-0257, an authentication-related vulnerability affecting the technology.
The attacker also probed SonicWall SMA VPN, Fortinet, Keycloak, Microsoft Exchange, and Next.js applications running on IIS servers. Researchers found evidence of API reconnaissance involving publicly available developer documentation and software packages, including Brazilian banking API specifications, an energy-sector OpenAPI schema, a 3CX web client bundle, and account-creation packages.
Operation Master also involved automated SQL injection attacks against Brazilian software-as-a-service platforms, customer relationship management systems, support services, educational applications, and financial web applications. The attacker additionally probed ASP.NET applications using __VIEWSTATE SQL injection techniques, targeting 21 financial organizations.
Other activities included exploiting CVE-2022-28368, a remote code execution vulnerability affecting Dompdf, and targeting enterprise Microsoft 365 environments through device-code phishing and password-spraying attacks. The operator also exploited CVE-2023-7028, a GitLab account-takeover vulnerability, to target GitLab instances belonging to an energy company.
The campaign extended to Japanese enterprises, where the attacker attempted to brute-force WordPress login pages using a dictionary containing four usernames and 66 passwords.
After gaining access to systems, the operator used tools such as GodPotato, Kerberoast, AS-REProast, and Evil-WinRM, alongside vulnerabilities including CVE-2021-4034, known as PwnKit, CVE-2024-1086, and CVE-2020-1938, also known as Ghostcat. These techniques were used for privilege escalation and movement between connected systems.
The attacker also relied on DNS tunneling, rclone, and SFTP to transfer stolen information from compromised environments. The AdaptixC2 framework was deployed to establish command-and-control capabilities on affected systems.
Researchers further identified an invoice-fraud platform linked to the operation that generated more than 2.4 million messages through email, SMS, and WhatsApp. It also created 622,666 personalized invoice links targeting Brazilian consumers and businesses before the platform went offline in mid-September 2026.
The campaign’s objective was to trick recipients into making payments through Brazil’s Pix instant-payment system. The platform recorded 169,906 target interactions, potentially involving fraudulent invoices worth R$38.9 million. Across the tracked shortened links, the cumulative invoice value reached R$150.4 million.
SOCRadar said the operation combined attacks against network infrastructure, sophisticated web application exploitation, AI-assisted development, and data theft to support an automated financial fraud ecosystem.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Like CyberXero, the masterblack operator reportedly used Claude-powered AI agents to develop intrusion code and data-exfiltration scripts. The operator focused on building the fraud platform’s interface and creating custom extensions for AdaptixC2.
Recovered AI refusal transcripts also showed repeated attempts to present offensive development requests as authorized bug-bounty work or penetration testing, even when the requested capabilities matched activities observed elsewhere in the operation.
