Four Campaigns, Four Ways In: CyberXero, Adception, Operation Master and DarkSword Indicators Are Now in Our Feed
Five research teams published four campaigns in the last three weeks, and each one got in a different way: a WordPress bug run by a swarm of AI agents, a Google ad that bounced through Bing to a fake Claude installer, a VPN authentication bypass that ended in fake utility bills, and an expired analytics domain that turned old store code into an iPhone exploit funnel. None of this is our discovery. SOCRadar, Push Security, Censys, iVerify and Report URI did the work. What we did was harvest their published indicators on October 12, check them against the rest of our corpus, write 93 of them into our feed, and read every one back. Here is what each campaign does, what we fed, and what other feeds already said about it.
CyberXero: an access broker that runs a swarm of AI agents
SOCRadar's Threat Research Unit published this one on October 6. CyberXero is the forum alias of a financially motivated initial access broker, someone who breaks into organizations and sells the way in. SOCRadar describes a Russian-speaking operator who first stood up infrastructure in July 2026 and was still active at publication. What sets it apart is scale from one person: SOCRadar found a swarm of 51 Claude Code agents on the operator's workstation, plus the PentAGI framework wired into Cobalt Strike. The session logs show the operator rephrasing requests as "my own site" and opening fresh sessions after refusals, and they also record the model refusing to install a backdoor or deploy a webshell.
There are two pipelines. The opportunistic one sweeps WordPress and e-commerce sites worldwide, and SOCRadar logged 32 shells deployed in a 61-second window. The directed one did careful reconnaissance against seven Ukrainian energy and utilities entities, including the national transmission system operator. The ways in include a homegrown tool SOCRadar calls wp2shell, which abuses a WordPress REST API batch-endpoint bug (CVE-2026-63030) to create a rogue admin and drop a webshell, a time-based SQL injection in Support Board (CVE-2026-4815), an old Magento bug (CVE-2015-1397), password spraying, and Redis rogue replication to plant SSH keys. Targets also included Poland, China and Pakistan.
We fed 12 indicators under source manual-batch-cyberxero-2026-10: eight IPs and four file hashes (the stager, a WSO-family PHP shell, and two binaries). Among them: 46.21.250[.]135, 45.88.106[.]2, 212.193.31[.]189 and 91.208.184[.]148. When we correlated them, ThreatFox already listed 42.193.227[.]214 as Cobalt Strike and 49.234.12[.]182 as VShell, a C2 framework SOCRadar's write-up does not mention. We scored those two Tencent Cloud addresses at 75, not 90, because shared cloud space churns.
If you run WordPress, look for admin users named wp2_ followed by eight hex characters, and for plugin folders named wp2shell_ followed by eight hex characters under wp-content/plugins. If you run Redis on the internet, check authorized_keys for entries you did not add.
Adception: a Google ad that hides behind Bing, then lies on your clipboard
Luke Jennings at Push Security published this on October 9. A Google search ad for "claude mac" displayed bing.com as its domain. Clicking it went through Google's ad redirect, then Bing's click-tracking redirect, then a search-indexed "about us" page on a hacked, legitimate South American homeopathy retailer, and finally to a polished fake Claude download page. Because the ad pointed at a real Bing search result, Google's ad review saw only another search engine. Push calls the trick Adception.
The fake page shows Anthropic's real one-line install command. The Copy button puts a different command on your clipboard, one that prints a legitimate-looking Claude URL, decodes a hidden one, and pipes a script from lake-90[.]com into zsh. Push classes this as InstallFix, a cousin of ClickFix, and links the domains to a toolkit it tracks as AcSig. Push does not name the payload.
We fed 10 indicators under source manual-batch-adception-2026-10: nine domains and the payload URL. Among them: claude-desk-code[.]com, cli-desktop[.]com, too.clawddddd[.]com and lake-90[.]com. When we correlated them, ThreatFox already listed cli-desktop[.]com as MacSync, a macOS stealer. That is a hint about the likely payload, not proof of it. Push itself says indicator-based detection for this kind of campaign has limited value because the domains rotate fast, and we agree. Pull them anyway, but the durable defense is behavioral.
Install developer tools from the vendor's own site, typed in by hand, not from a search ad. Read any command after you paste it and before you press Enter. A curl that pipes into zsh from a domain you have never heard of is the whole attack.
Operation Master: steal the data, sell it, then bill the victims
SOCRadar's Threat Research Unit published this on September 24, covering activity from April 23 to mid-September. It began with one misconfigured exploitation server with open directories, and tracing it uncovered three generations of hosting. SOCRadar assesses with high confidence that a forum persona called masterblack is tied to the principal operator.
The main way in was an authentication bypass in Palo Alto GlobalProtect (CVE-2026-0257), which gave access to seven gateways in four countries. Others included SQL injection escalated to command execution through xp_cmdshell, a dompdf flaw, GitLab CVE-2023-7028, Microsoft 365 device-code phishing and vishing. The C2 was AdaptixC2, with a Go agent and a custom loader. SOCRadar counted 21 compromised organizations, 16 of them in Brazil.
The money side is the striking part. The operator sold stolen energy-sector data on a forum, then loaded the same victims into a fake-invoice platform skinned to look like Brazilian utility brands iGreen Energy, Wattio and NUV, and sent links by hijacked Microsoft 365 mailboxes, SMS and WhatsApp. Each victim got a personal PIX payment code. SOCRadar counts R$150.4 million attempted across 622,666 links and R$38.9 million exposed through clicks, and is careful to say those are attempted and exposed amounts, not confirmed stolen funds.
We fed 24 indicators under source manual-batch-operation-master-2026-10: four IPs, six domains and 14 file hashes, including beacon DLLs, the Go agents, two JSP webshells and a Metasploit WAR payload. Among them: yzs[.]fi (the panel), igreenfaturas[.]com, wattiofaturas[.]com, nuvfaturas[.]com and 91.92.241[.]187. When we correlated them, ThreatFox already listed 85.120.216[.]8, 91.92.241[.]184 and 91.92.241[.]187 as AdaptixC2 on port 4321. We scored pix-proxy-sable.vercel[.]app at 75, and fed only that exact subdomain, never the vercel.app platform.
Patch GlobalProtect. Turn off xp_cmdshell on any internet-reachable database identity. Disable the OAuth device-code flow where nobody needs it. And treat any unsolicited bill that asks for an instant PIX payment as fraud until proven otherwise.
DarkSword: an expired analytics domain turned into an iPhone exploit funnel
Three teams published pieces of this in three days. Censys (Aidan Holland, October 7) found five open directories, exposed September 15 to 17, belonging to a DarkSword operator, including a packaged bundle the operator labeled DS-Fusion v1.0, a live C2 with victim telemetry, and a staging host for Coruna, the companion kit that steals crypto wallet recovery phrases. iVerify (October 8) documented a variant it calls P7 after an alert on a customer device in August, with keychain and wallet theft and a beacon every 15 seconds by default. Report URI (Scott Helme, October 9) found how ordinary people reach it.
That last part is the one every site owner should read. ecomtrack[.]io was the analytics product of a Czech startup that went away. Its domain expired and was re-registered on September 15, 2026. Online stores that still had the old tag in their theme began loading the new owner's script. That script filters out bots and data center traffic, sells real visitors through traffic brokers to scam and casino pages, and sends some to a hidden page that checks for Safari on iOS 18.4.0 to 18.7.2 and loads the exploit chain with no further clicks. A dead lead-gen SDK, sdk.araleads[.]com, was re-registered on August 25 and runs the same kit. Censys says the 18.x chain is patched in iOS 18.7.3 and 26.3.
We fed 47 indicators under source manual-batch-darksword-2026-10: 15 IPs, 23 domains and nine file hashes, drawn from all three reports. Among them: ecomtrack[.]io, api.ecomtrack[.]io, sdk.araleads[.]com, zhengxin021[.]top, mertio[.]cc, cdn.gotoiphone[.]com, 166.88.95[.]90 and 112.213.108[.]85. When we correlated them, ThreatFox already listed 166.88.95[.]90 as Sliver C2, and listed hdios[.]cn and i.131422[.]com without naming a family. Censys asks that two addresses, 154.219.127[.]147 and 154.219.127[.]94, be excluded from operator lists, and we did not feed them.
Update iPhones to a current iOS release. If you run a website, list every third-party script tag in your templates and remove anything you no longer use. A tag for a dead company is a door the next domain owner holds the key to.
What to do
Start with the fixes, because indicators expire and patches do not: patch GlobalProtect, update iPhones, prune old script tags from your site, hunt WordPress for wp2_ accounts and wp2shell_ plugin folders, and never paste an install command you have not read.
Then pull the indicators. All 93 are in our feed now, in ips.csv, domains.csv and hashes.csv at analytics.dugganusa.com. The ips.csv list defaults to min_confidence=50, which includes everything here; if you only want the 90s, raise it with min_confidence=90 (we scored shared-cloud and platform hosts at 75). The free tier allows 25 queries a day. Each campaign carries its own source tag, manual-batch-cyberxero-2026-10, manual-batch-adception-2026-10, manual-batch-operation-master-2026-10 and manual-batch-darksword-2026-10, so you can search or drop a campaign as one unit.
To be plain about what this is: the research belongs to SOCRadar, Push Security, Censys, iVerify and Report URI. We did not see any of these first. Our part is the plumbing that turns six published reports into rows a cash-poor defender can block today, plus the corroboration we found along the way.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=four-campaigns-four-ways-in-cyberxero-adception-operation-master-darksword
Comments