CyberXero Hits WordPress E-Commerce, Energy Sector in Two Campaigns

Key points

• CyberXero ran two distinct attack campaigns.
• Targets included WordPress sites and e-commerce platforms.
• About 628,000 records were stolen, exposing sensitive data.
• Energy infrastructure also suffered a breach.
• No CVEs were assigned; SOCRadar researchers reported the activity.

Analysts at SOCRadar have linked a pair of distinct campaigns to the threat actor known as CyberXero. These operations leveraged fifty-one autonomous AI agents to automate intrusion and data exfiltration. The primary targets were websites built on WordPress and online retail systems, though the impact extended beyond those platforms.

The campaigns resulted in the theft of approximately 628,000 individual records. Much of that data included sensitive information, raising the risk of identity theft and financial fraud for affected users. Separately, a breach of energy infrastructure was also attributed to this activity, highlighting a dangerous expansion into critical systems.

E-commerce businesses and WordPress site operators are most directly affected, but the energy sector intrusion shows that the threat is not limited to web applications. The absence of assigned CVE identifiers means defenders cannot rely on patch-specific alerts; instead, behavioral detection and hardening are essential.

This matters because the combination of AI-driven automation and multi-sector targeting increases both the speed and scale of attacks. CyberXero's use of two campaigns suggests a deliberate strategy to diversify victims and evade single-point defenses. Organizations should assume that similar tooling could be repurposed against other platforms.

What to watch: further reports from SOCRadar, any signs of data leak sites offering the stolen records, and whether energy sector regulators issue new advisories. Security teams should monitor for unusual outbound traffic from WordPress and e-commerce servers, and review access logs for unauthorized data access.

What to do now

1. Immediately audit WordPress installations for unauthorized admin accounts, plugins, and themes; remove anything unrecognized.
2. Enforce multi-factor authentication on all WordPress and e-commerce admin panels, and rotate credentials for privileged users.
3. Deploy network monitoring to detect anomalous outbound data transfers, especially from web servers hosting e-commerce or energy-related services.
4. Apply virtual patching or web application firewall rules to block common exploitation patterns, since no CVEs are available.
5. Segment energy infrastructure networks from corporate IT and internet-facing systems; restrict outbound traffic to known-good destinations.
6. Back up critical data offline and test restoration procedures; ensure backups are not accessible from compromised web servers.
7. Brief staff on phishing and social engineering, as AI agents may be used to craft convincing lures.

Original source

Security Affairs