Researchers link Claude Code agents to ongoing Ukrainian data theft campaign

SOCRadar researchers linked an ongoing intrusion campaign to the theft of more than 628,000 records tied to Ukrainian individuals, The Hacker News reported. The researchers attributed the activity to CyberXero, a Russian-speaking initial access broker targeting websites globally and Ukrainian energy and utilities more selectively. An exposed attacker directory contained AI session logs, exploitation tools and stolen data. Researchers said the operator used Claude Code with 51 specialized agents for scanning, reconnaissance and exploitation. One automated execution scanned 4,708 targets, confirmed access to 429 WordPress administration panels and deployed 32 web shells within 61 seconds. The logs also showed refusals that held, including repeated rejection of a scan and a forged ownership token.