CVE Tools
Track your stack

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

The Hacker NewsBy The Hacker News

Reported exploitedClaude CodeCyberXeroPentAGI

Our summary

{"title":"CyberXero Uses Claude Code AI Agents to Steal 628,000+ Ukrainian Records","seo_title":"CyberXero exploits WordPress via Claude AI","seo_description":"Active since July 2026: CyberXero used Claude Code and PentAGI with Cobalt Strike to exploit CVE-2026-63030, CVE-2026-60137, CVE-2026-4815, stealing 628K+ Ukrainian records."}

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsEight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and StealerCVE-2026-60137, CVE-2026-63030
  2. BleepingComputerChinese hackers exploit WordPress, Zyxel flaws to steal govt dataCVE-2026-60137, CVE-2026-63030
  3. Help Net SecurityAttacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)CVE-2026-60137, CVE-2026-63030
  4. Rapid7 BlogMetasploit Wrap Up: Lot of summer shells and fit http profilesCVE-2026-60137, CVE-2026-63030
  5. PatchstackWordPress 7.0.3 Released: 12 Vulnerabilities Found and FixedCVE-2026-60137, CVE-2026-63030
  6. Cisco TalosDon’t swing at everythingCVE-2026-60137, CVE-2026-63030
  7. The Hacker NewsHackers Exploit Windmill Flaw to Read Arbitrary Server Files Without AuthenticationCVE-2026-60137, CVE-2026-63030
  8. Хакер (xakep.ru)Критическую проблему в WordPress уже применяют для установки веб-шелловCVE-2026-60137, CVE-2026-63030
  9. PatchstackNinety minutes: watching attackers weaponize the WordPress core RCECVE-2026-60137, CVE-2026-63030
  10. BleepingComputerCritical wp2shell WordPress flaws exploited to install webshellsCVE-2026-60137, CVE-2026-63030

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure