WordPress sites hit in AI-assisted access campaign

WordPress sites were a major target in an AI-assisted initial access campaign that SOCRadar says combined automated exploitation, manual reconnaissance and commodity attack tools against website and infrastructure targets.

SOCRadar attributed the activity to CyberXero, a Russian-speaking, financially motivated initial access broker assessed to have been active since at least July 2026. The campaign had two tracks: a broad automated effort against WordPress and e-commerce platforms, and a more selective effort against Ukrainian energy and critical infrastructure organizations. According to SOCRadar, the activity is ongoing.

The global website-focused campaign targeted known WordPress weaknesses, including wp2shell, tracked as CVE-2026-63030 and CVE-2026-60137, and CVE-2026-4815, an SQL injection flaw in the Support Board WordPress plugin. SQL injection means a vulnerable website can be tricked into sending unintended database commands, which can expose or change stored information. SOCRadar said the campaign was built to obtain access and payment data from WordPress and e-commerce systems.

SOCRadar said it found the operation after identifying an exposed open directory at 46.21.250[.]135. An open directory is a web-accessible folder that can expose files if it is not properly restricted. The directory reportedly revealed the operator's live working area for a Linux workstation, including AI session logs, scripts containing plaintext tokens, exploitation tools, reconnaissance output, AI agent settings and exfiltrated victim data. Plaintext tokens are secret access values stored in readable form, which can make a compromise worse if they are copied.

The confirmed impact described by SOCRadar includes exfiltration from four Ukrainian organizations, with more than 628,000 records tied to Ukrainian individuals harvested. The company also reported confirmed compromises in Poland, China and the Netherlands. One automated run scanned 4,708 targets, confirmed access to 429 WordPress administration panels and deployed 32 web shells in 61 seconds. A web shell is a small malicious file placed on a website so an attacker can run commands through the site.

SOCRadar described the attack setup as eight separate nodes, including the operator's Linux workstation, a provisioning server, monetization infrastructure, payload staging servers and a scanner used to identify targets. In plain terms, the setup separated the work of finding sites, preparing attack files, staging payloads and turning access into value.

The AI component is what makes this case stand out for website owners and IT teams. SOCRadar said CyberXero used Anthropic's Claude Code with a cluster of 51 specialized agents for scanning, chaining exploits, reconnaissance and post-exploitation tasks on the operator's main workstation. It also connected PentAGI, an open-source self-hosted AI agent for autonomous penetration testing, to Cobalt Strike through an AI provider API. Cobalt Strike is a legitimate red-team tool that is also frequently abused for unauthorized access and control.

SOCRadar reported that the operator tried to bypass model refusals by changing the context of sessions and restarting them, while presenting tasks as an authorized penetration test on owned infrastructure. The company said some refusals still held: across four attempts, the model declined requests to install a backdoor, disable a firewall, move laterally and deploy a web shell. In another episode, it refused a scan four times and rejected a forged ownership token.

The same reporting also described exploitation of exposed Redis servers, which led to breaches of two Chinese entities. Redis is an in-memory data store often used by applications for fast access to data. SOCRadar advised organizations running WordPress, Magento or PrestaShop, or exposing Redis to the internet, to check for rogue WordPress administrator accounts, WSO web shells and unexpected entries in ~/.ssh/authorized_keys on Redis hosts. The authorized_keys file controls which SSH keys can log in to a server account.

SOCRadar separately detailed another cybercrime operation, called Operation Master, that compromised enterprise networks, stole customer and billing databases, offered some of the data on underground forums and reused data in an automated invoice-fraud platform. Between April and mid-September 2026, the operator was observed scanning for Palo Alto Networks PAN OS GlobalProtect gateways and exploiting CVE-2026-0257. The same activity probed SonicWall SMA VPN, Fortinet, Keycloak, Microsoft Exchange and Next.js-on-IIS endpoints.

Operation Master also included API reconnaissance using public developer documentation and software packages, automated SQL injection against Brazilian SaaS, customer relationship management, support, education and financial web applications, and ASP.NET __VIEWSTATE SQL injection attempts against 21 financial organizations. SOCRadar also listed exploitation or use of CVE-2022-28368 in Dompdf, CVE-2023-7028 in GitLab, CVE-2021-4034, CVE-2024-1086 and CVE-2020-1938. The operator also targeted Microsoft 365 tenants with device-code phishing and password spraying, and brute-forced WordPress login pages tied to Japanese enterprises using a dictionary of four usernames and 66 passwords.

After entry, SOCRadar said Operation Master used tools including GodPotato, Kerberoast, AS-REProast, Evil-WinRM, DNS tunneling, rclone, SFTP and AdaptixC2. DNS tunneling hides data movement inside DNS traffic, while rclone and SFTP can be used to copy files from one system to another. The invoice-fraud engine generated more than 2.4 million email, SMS and WhatsApp messages and 622,666 personalized invoice links aimed at Brazilian consumers and companies before going offline in mid-September. SOCRadar said the platform recorded 169,906 target interactions, potentially leading to R$38.9 million in fraudulent invoices, while click-tracked short links represented a cumulative invoice value of R$150.4 million.

For site owners, the practical lesson is not that every attack needs exotic AI to succeed. The reported activity relied heavily on familiar weaknesses: unpatched WordPress components, exposed services, weak login defenses, internet-facing VPNs and stolen or poorly protected credentials. AI agents may speed up scanning, exploit chaining and code generation, but the entry points described by SOCRadar are still the same kinds of systems businesses already need to maintain.

For readers running WordPress sites, AEU Hosting is relevant because it is managed WordPress hosting, secured end to end, which directly matches the kind of website environment targeted in this campaign.

The immediate priorities are to patch website software and plugins, remove unnecessary internet exposure, review administrator accounts and look for unfamiliar files or access keys.