#wordpresssecurity

Read Time:3 Minute, 27 Second

A Russian-speaking operator tracked as CyberXero has blended commercial AI coding agents with established offensive tools to run both high-volume website attacks and targeted operations against Ukrainian energy organizations. Evidence recovered from an exposed working directory suggests the actor is functioning as an initial-access broker: compromising systems, collecting data and potentially preparing access that could be reused or sold.

Researchers at SOCRadar connected the campaign after discovering more than 90,000 exposed files, including scripts, AI session histories, configuration records and stolen information. The operation reportedly affected more than 40 organizations across several countries and remained active during the investigation.

Two layers of AI-assisted intrusionCyberXero did not use AI only for advice or code snippets. On a primary workstation, the operator configured as many as 51 Claude Code agents with specialized roles covering web discovery, credential testing, exploitation and data collection. A separate environment linked the PentAGI AI penetration-testing framework to a Cobalt Strike team server through an AI provider API.

Recovered settings indicate that models and token budgets were assigned according to the difficulty of each task. Lower-cost roles handled routine searches and software installation, while more capable configurations were reserved for payload generation. This orchestration shows how an individual operator can distribute work across multiple agents and compress activities that once required more manual coordination.

In one automated run, the system scanned 4,708 targets, identified 429 accessible WordPress administration panels and reportedly planted 32 shells in 61 seconds. The figures illustrate the main defensive challenge posed by agentic tooling: it can move from discovery to exploitation across a large target set with very little delay.

Safeguards were tested and sometimes bypassedSession records show the operator presenting malicious tasks as authorized security testing. When an agent refused, CyberXero sometimes opened a fresh session and reused the same prepared explanation. Other safeguards held, including refusals to install a backdoor, disable a firewall, move laterally and deploy a web shell.

This uneven result matters to both AI providers and enterprise users. A refusal inside one conversation is less valuable if a new session resets the relevant context. It also makes AI session records highly sensitive. Logs can reveal target information, credentials, attack logic and operational infrastructure, so organizations should encrypt them, tightly limit access and preserve reliable audit trails.

Mass compromise met targeted reconnaissanceThe broad pipeline focused on WordPress and e-commerce sites. An internal package called wp2shell used a WordPress REST API batch route as part of a chain that injected SQL, created rogue administrator accounts and installed WSO-family web shells on vulnerable installations. The actor also targeted Magento and exploited a recently disclosed Support Board vulnerability within roughly a month of publication.

A more selective track mapped seven Ukrainian energy and utility entities. Across two organizations, the actor enumerated 95 subdomains and catalogued email, VPN and network-dispatch services. Researchers found file-confirmed theft at four Ukrainian organizations. Data associated with a Kharkiv district-heating provider included 564,073 subscriber records and 213,340 access-log entries, reportedly reached with a hardcoded credential found in the operator’s own tooling.

The investigation also linked eight infrastructure nodes across European hosting providers and Tencent Cloud. Shared artifacts connected mass scanning, staging, Cobalt Strike services and operator workstations. Although researchers did not prove that access had already been sold, the mix of opportunistic compromise and infrastructure-specific reconnaissance creates a credible follow-on risk.

Defensive prioritiesPatch WordPress core, plugins, e-commerce platforms and internet-facing support software promptly.

Search for unfamiliar administrator accounts and plugin paths matching rogue wp2shell-style installations.

Review web logs for rapid REST API batch activity, SQL injection attempts and unexpected shell uploads.

Restrict internet exposure for Redis, rotate embedded credentials and audit authorized SSH keys.

Treat AI-agent histories, configuration files and API tokens as sensitive security assets.

CyberXero’s importance lies less in any single tool than in the workflow connecting them. AI agents, exploitation frameworks and commodity post-compromise tooling can now form a repeatable pipeline. Defenders should expect shorter intervals between vulnerability discovery, scanning and compromise—and tune monitoring and patch operations accordingly.

Read Time:4 Minute, 22 Second

Security researchers at LevelBlue have pulled back the curtain on a credential-harvesting toolkit, internally named TIKTOUK, that turns an everyday WordPress mistake — leaving a site backup or configuration file sitting in a publicly reachable location — into a pipeline for stealing cloud and email credentials at scale. A leaked control panel used to run the operation revealed roughly 50,000 real, server-side credentials gathered from about 37,000 domains, including hundreds of AWS access keys that the researchers confirmed were still active.

Rather than relying on one single exploit, TIKTOUK bundles several different collection techniques together: scanning sites for exposed sensitive files, recovering stored passwords from plugin configurations, and scraping secrets out of JavaScript served to ordinary site visitors. LevelBlue says the operation was already running at meaningful scale by the time it was identified through a combination of source code review, reverse engineering, and controlled lab testing.

Inside the Toolkit’s ArchitectureTIKTOUK is built from two Python components plus a Linux-based crawler written in Go, all of which check in with a central HTTP service to receive tasks and report back findings. The coordination layer distributes targets and collects results, though LevelBlue’s testing didn’t find evidence of a fully automatic handoff between the different components — suggesting a human operator may still be steering parts of the operation.

The probing component handles initial reconnaissance: it pulls a list of targets, confirms which ones are running WordPress, and then sends specially crafted REST API batch requests that combine a malformed URL with delete and content-rendering operations. When a request formatted as JSON gets rejected, the tool automatically retries using multipart encoding instead — and that retry frequently succeeds. That specific fallback pattern, LevelBlue notes, gives defenders a distinctive signature to hunt for in their own web server logs.

Turning a Backup File Into a Credential DumpA separate collection module goes after exposed WordPress configuration backups directly, pulling database credentials and WordPress security keys out of them. It doesn’t stop there — the same component also probes for exposed environment files, repository configuration, raw database backups, and debug logs, essentially sweeping up anything left accessible through a plain web request that shouldn’t be.

Some of its database queries are notably methodical: nested batch requests first retrieve the name WordPress uses for its options table, then feed that name into follow-up queries designed to pull the option values themselves. The tool decodes hexadecimal-encoded responses back into readable text and assembles structured records containing database settings, stored email credentials, AWS key pairs, and recognizable API key patterns.

From Website Compromise to Cloud TakeoverThe blast radius extends well past the compromised website itself. The leaked operator panel contained AWS keys with the potential to be abused for sending email, spinning up compute resources, or accessing AI services tied to the victim’s cloud account. TIKTOUK’s collector can specifically decrypt stored settings from popular SMTP plugins — WP Mail SMTP, Easy WP SMTP, and FluentSMTP — recovering plaintext email credentials using encryption keys or configuration material the tool already has access to. LevelBlue is careful to note this isn’t a cryptographic breakthrough; the toolkit simply gets its hands on what it needs to unlock settings that were never meant to be exposed in the first place. In one particularly efficient step, it can even derive an Amazon SES email password directly from a stolen AWS secret key.

A third piece, the JavaScript crawler, fetches site pages and any scripts they load, scanning the contents for credential patterns tied to services like SendGrid, Anthropic, AWS Bedrock, and AWS more broadly — all secrets that were likely embedded in client-side code by mistake and shipped straight to every visitor’s browser.

Exploitation Links and What’s Still UnconfirmedLevelBlue connected TIKTOUK’s request patterns to two specific vulnerabilities, CVE-2026-60137 and CVE-2026-63030, which affect a batch-route mechanism in WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2. Importantly, the firm’s lab testing didn’t go as far as demonstrating a full working exploit — controlled test targets returned pre-prepared responses without actually executing attacker-supplied SQL. That said, separate incident telemetry did confirm the toolkit successfully retrieved payloads and communicated with its controller infrastructure in the wild, and investigators separately identified a related Go-based botnet capable of remote command execution.

In short: the lab results establish exactly how the components behave, not that a specific live production site has been fully breached end-to-end using this chain. Site operators shouldn’t read that distinction as reassuring, though, given the scale of credentials already found in the leaked panel.

What WordPress Site Owners Should CheckConfirm backup files, configuration exports, and debug logs are never stored inside a publicly web-accessible directory.

Update WordPress past the affected 6.9.x and 7.0.x ranges identified in the advisory.

Rotate SMTP plugin credentials and any AWS keys that may have been referenced in configuration files or client-side JavaScript.

Watch server logs for the JSON-then-multipart retry pattern on REST batch endpoints as a potential sign of probing activity.

Audit JavaScript served to visitors for hard-coded API keys or secrets that should never have been placed there.