Recent findings from cybersecurity researchers reveal an AI-enhanced campaign by the group CyberXero targeting WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. This campaign, which started in July 2026, combines tools like Cobalt Strike with AI orchestration from Anthropic's Claude Code. CyberXero, a Russian-speaking group, has been linked to the exfiltration of over 628,000 records from four Ukrainian organizations. The campaign also affected entities in Poland, China, and the Netherlands. SOCRadar discovered the operation by uncovering an open directory with detailed logs, scripts, and exfiltrated data. The operation consists of two parts: a global automated attack on WordPress and e-commerce platforms and a more targeted attack on Ukrainian critical infrastructure. The global campaign exploits known vulnerabilities such as wp2shell and an SQL injection flaw, while the targeted campaign focuses on reconnaissance and manual exploitation. CyberXero's infrastructure includes a network of nodes for scanning, staging, and monetization. The group cleverly bypasses AI model refusals by resetting sessions and framing activities as authorized tests. The campaign's broader impact extends to exposed Redis servers, affecting two Chinese entities. Organizations using WordPress, Magento, PrestaShop, or exposing Redis servers are advised to be vigilant against unauthorized access. This disclosure is part of a larger trend where AI is being used for complex cybercrime operations, as seen in a parallel operation called Operation Master, which targeted Brazilian consumers and corporations with invoice fraud.