Critical

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

The Hacker News

October 12, 2026 at 7:26 AM

Actively Exploited

Overview

Cybersecurity researchers have reported a sophisticated campaign that has compromised over 628,000 records from Ukrainian entities. The attackers utilized a combination of traditional hacking tools like Cobalt Strike and an AI component powered by Anthropic's Claude Code to gain initial access to various targets, including WordPress sites and e-commerce platforms. This dual approach not only increases the efficiency of the attacks but also poses significant risks to critical infrastructure in Ukraine. The scale of the data breach is alarming, particularly given the ongoing geopolitical tensions in the region. Organizations in Ukraine must strengthen their defenses and remain vigilant against these evolving threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: WordPress sites, e-commerce platforms, Ukrainian critical infrastructure
Action Required: Organizations should enhance security measures for WordPress and e-commerce platforms, conduct regular security audits, and implement advanced threat detection systems.
Timeline: Newly disclosed

Original Article Summary

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

Impact

WordPress sites, e-commerce platforms, Ukrainian critical infrastructure

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance security measures for WordPress and e-commerce platforms, conduct regular security audits, and implement advanced threat detection systems.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach, Critical.

Read Original Article

Related Coverage

Bring Your Own Agent: Your Employees' Assistants Are Already Logged In

The Hacker News

The article discusses the challenges and privacy concerns arising from the increasing use of personal AI agents in workplaces. Companies like Amazon are taking steps to protect users by blocking certain bots, such as Meta's Muse, that fail to disclose their identity during online interactions. Meanwhile, the use of AI assistants raises significant privacy issues, as employees may inadvertently expose sensitive company data while interacting with these tools. The rapid adoption of these technologies has left many organizations grappling with how to manage their use effectively and safely. This situation emphasizes the need for clear policies and guidelines regarding the integration of AI agents in professional settings, as the potential for data leaks and privacy violations continues to grow.

Oct 12, 2026

Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports

The Hacker News

Ledger, a cryptocurrency hardware manufacturer, has halted sales through a reseller named CryptoBilis after reports surfaced about unauthorized hardware implants in wallets sold by the company. Users in Southeast Asia have reported losing funds, with losses totaling over $86. The company is currently investigating these claims to understand the extent of the issue and to determine how these unauthorized devices made their way into the market. This incident raises concerns about the integrity of hardware wallets and the potential risks users face when purchasing crypto products from third-party sellers. It's crucial for users to be cautious and ensure they are buying from reputable sources to protect their funds.

Oct 12, 2026

Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

The Hacker News

A serious security vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances has been exploited by attackers shortly after it was made public. This flaw, identified as CVE-2026-102255, has a maximum severity score of 10.0 and involves pre-authenticated server-side request forgery (SSRF), which could enable remote attackers to manipulate the appliance into making unauthorized requests. SonicWall users are at risk, as the vulnerability has already seen 135 exploitation attempts. This situation underscores the urgency for affected organizations to act quickly to secure their systems and protect sensitive data from potential breaches.

Oct 12, 2026

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

The Hacker News

A serious security vulnerability has been discovered in the Bricksforge plugin for WordPress, identified as CVE-2026-85097, which has a maximum severity score of 10.0. This flaw allows unauthenticated attackers to upload and run arbitrary PHP code on affected WordPress sites, leading to remote code execution (RCE). According to Patchstack, the exploit is currently being actively used in the wild, putting numerous WordPress installations at risk. Website owners using the Bricksforge plugin should take immediate action to secure their sites against this threat, as the vulnerability could lead to significant data breaches or site compromises. It's crucial for users to stay updated with security patches and monitor their systems for any unusual activity.

Oct 12, 2026

AI vulnerability patching has a grading problem

Help Net Security

Researchers from Northwestern University conducted a study on AI coding tools, specifically testing how well they could handle real security bugs. They analyzed 112 actual vulnerabilities and found that even when a patch eliminated a crash, a significant number of these patches—about one-third from Claude Opus 4.7—still failed to meet the tests set by project maintainers. This raises concerns for developers considering AI tools for vulnerability patching, as relying on AI could lead to unresolved issues in security checks. The findings suggest that while AI can help in addressing some vulnerabilities, it may not fully align with the quality standards necessary for effective security management, which could leave systems at risk.

Oct 12, 2026

Nippon Columbia malware incident exposes 8.6 million karaoke fan records

BleepingComputer

Daiichi Kosho, a prominent Japanese entertainment system manufacturer, has reported a significant data breach involving its contractor, Nippon Columbia. Malware infiltrated Nippon Columbia's systems, leading to the exposure of over 8.7 million records belonging to customers and employees. This incident raises concerns for karaoke enthusiasts and employees, as their personal information may be compromised. The breach not only affects individual privacy but could also undermine trust in the companies involved. It's a stark reminder for organizations to prioritize cybersecurity measures to protect sensitive data from similar threats in the future.

Oct 11, 2026