CyberXero Used 51 AI Agents to Scale Web Attacks in Seconds

SOCRadar says a Russian-speaking initial access broker called CyberXero used a cluster of 51 AI agents to automate attacks against WordPress and e-commerce sites while separately pursuing Ukrainian energy and critical infrastructure targets.

In one observed run, the system scanned 4,708 targets and deployed 32 web shells in 61 seconds, according to analysis shared with Enterprise Security Tech. The operation combined Claude Code with an open-source penetration-testing agent, showing how commercially available AI tooling can compress reconnaissance, exploitation and persistence into an unusually short window.

The entry points were familiar rather than exotic: known WordPress plug-in flaws, internet-exposed Redis servers and unauthorized administrator accounts. That matters because AI did not invent a new class of weakness. It made routine weaknesses cheaper to find and exploit at scale.

For defenders, the practical lesson is speed. Annual exposure reviews and slow patch cycles are poorly matched to attackers that can move from scanning to a web shell in about a minute. Continuous attack-surface monitoring, rapid remediation and alerting on new administrator accounts, keys and configuration changes are becoming baseline controls.