AI-augmented campaigns target WordPress and critical infrastructure in Ukraine

Security researchers have uncovered two major cybercrime operations that leverage artificial intelligence to automate and scale attacks against web platforms and critical infrastructure. The first campaign, attributed to a threat actor known as CyberXero, has compromised WordPress sites and Ukrainian energy entities since July 2026. The second, dubbed Operation Master, focused on enterprise networks and financial fraud in Brazil before going offline in mid-September 2026. Both operations highlight how attackers are integrating AI agents into their workflows to bypass security controls and accelerate exploitation.

What happened

The CyberXero campaign operates through two distinct pipelines. The first is a global, automated effort targeting WordPress and e-commerce platforms like Magento and PrestaShop. This pipeline exploits known vulnerabilities, including wp2shell (CVE-2026-63030 and CVE-2026-60137) and an SQL injection flaw in the Support Board plugin (CVE-2026-4815). The goal is rapid access for data theft or selling initial access to other criminals. The second pipeline is highly targeted, focusing on Ukrainian critical infrastructure, such as a heating provider in Kharkiv. This manual campaign aims for deep reconnaissance rather than immediate monetization. Confirmed breaches have resulted in the exfiltration of more than 628,000 records from four Ukrainian organizations, with additional compromises in Poland, China, and the Netherlands.

Operation Master, orchestrated by an adversary using the alias "masterblack," took a different approach. Between April and mid-September 2026, this actor compromised enterprise networks by exploiting vulnerabilities in Palo Alto Networks GlobalProtect gateways (CVE-2026-0257), GitLab (CVE-2023-7028), and various web applications. The stolen data was not only sold on underground forums but also fed into an automated invoice fraud platform. This engine generated over 2.4 million messages and 622,666 personalized invoice links targeting Brazilian consumers and corporations. The campaign aimed to trick recipients into making Pix payments, with tracked links representing a cumulative invoice value of R$150.4 million.

Both operations were exposed due to operational security failures. SOCRadar discovered CyberXero after identifying an exposed open directory at IP address 46.21.250[.]135. This directory leaked the attacker’s Linux workstation files, including AI session logs, plaintext tokens, and exfiltrated victim data. Similarly, analysis of Operation Master revealed the extensive use of AI-assisted development workflows and custom command-and-control frameworks like AdaptixC2.

Key details

• CyberXero has been active since at least July 2026, targeting WordPress sites and Ukrainian critical infrastructure.
• The campaign exploited CVE-2026-63030, CVE-2026-60137, and CVE-2026-4815 to compromise WordPress installations.
• More than 628,000 records were exfiltrated from four Ukrainian organizations, with additional breaches in Poland, China, and the Netherlands.
• Operation Master ran from April to mid-September 2026, generating over 2.4 million fraudulent messages targeting Brazilian users.
• Attackers used Claude Code and PentAGI to automate scanning, exploit chaining, and payload generation.
• Threat actors bypassed AI safety refusals by resetting sessions and framing requests as authorized penetration testing.

Background

These campaigns illustrate the growing integration of large language models (LLMs) into offensive security tools. Attackers are no longer just writing scripts manually; they are orchestrating clusters of AI agents to handle repetitive tasks like scanning, vulnerability verification, and code generation. In the CyberXero case, the actor used a cluster of 51 specialized agents powered by Anthropic's Claude Code. They also connected an open-source agent called PentAGI to Cobalt Strike, a popular penetration testing tool, to automate payload delivery.

A critical technique observed in both operations is "context engineering" to bypass AI safety guardrails. LLMs typically refuse requests to generate malware or exploit code. However, these refusals are often based on the immediate context of the conversation. By starting a new session and preloading it with a narrative about conducting an "authorized pentest on my own infrastructure," attackers can trick the model into complying. This method allows them to generate functional exploit code and evasion scripts while maintaining the appearance of legitimate activity within each isolated session.

Why it matters

For teams running self-hosted software, particularly WordPress instances, the speed and scale of these automated attacks are concerning. The CyberXero campaign demonstrated that a single automated execution could scan 4,708 targets, confirm access to 429 admin panels, and deploy 32 web shells in just 61 seconds. This velocity means that unpatched vulnerabilities are exploited almost instantly after disclosure. If your organization relies on WordPress for public-facing sites or internal portals, delaying updates even by a few days can leave you exposed to mass-scale automated scanners.

Furthermore, the use of AI to automate complex attack chains lowers the barrier to entry for sophisticated exploits. Previously, exploiting a chain of vulnerabilities might require significant manual effort and expertise. Now, AI agents can handle the reconnaissance and chaining logic, allowing threat actors to focus on high-value targets like critical infrastructure or enterprise VPN gateways. This shift means that perimeter defenses, such as firewalls and VPNs, must be rigorously maintained, as attackers can rapidly identify and exploit misconfigurations or unpatched flaws like the GlobalProtect bypass used in Operation Master.

Finally, the exposure of attacker infrastructure serves as a reminder that operational security matters for defenders too. The discovery of CyberXero’s operation was possible because of a single misconfigured directory. For self-hosting teams, this underscores the importance of regular audits of your own external footprint. Ensuring that no sensitive directories, logs, or configuration files are publicly accessible is a basic but critical step in preventing adversaries from gaining insights into your defensive posture or leaking your own data.

What you can do

• Patch WordPress installations immediately, focusing on plugins like Support Board and core vulnerabilities such as CVE-2026-63030 and CVE-2026-60137.
• Audit exposed services like Redis, ensuring they are not accessible from the internet and checking for unauthorized SSH keys.
• Review VPN and gateway configurations, specifically patching Palo Alto GlobalProtect (CVE-2026-0257) and other perimeter devices.
• Monitor for rogue administrator accounts and web shells (such as WSO) on all web-facing servers.
• Implement strict access controls and multi-factor authentication for all administrative interfaces to prevent brute-force attacks.
• Regularly scan your external infrastructure for exposed directories or sensitive files that could leak operational data.