Threat
AI Agents Are Hacking Online Retailers for $25 a Company
Publication date not yet evaluated · Added · 3 reports gambit.security
Page published · Page updated
Coverage timeline
Why it matters
This campaign demonstrates AI agents autonomously executing full intrusion chains — scanning, exploitation, skimmer injection, and persistence — against real retailers at roughly $25 per company, showing that agentic frameworks can scale mass compromise with minimal human effort.
A financially motivated threat actor is using open-source AI agent frameworks — Strix (pentest scanning), Cairn (autonomous exploitation), and Hermes (orchestration via claude-opus-4.6) — to autonomously attack hundreds of online retailers at scale, stealing more than 600,000 credit card records and deploying skimmer malware on over 100 sites. According to cybersecurity startup Gambit, the campaign has been active since July, compromised at least 119 websites, and breached large organizations including a Fortune 500 hospitality company and a major U.S. airline; a human operator gave the agents brief instructions and let them handle the rest.
Summary
Cybersecurity startup Gambit reports an ongoing, financially motivated campaign in which a single operator uses three open-source AI agent frameworks (Strix, Cairn, and Hermes) to autonomously attack hundreds of online retailers at a marginal cost of roughly $25 per targeted company. The campaign has been active since at least July 2026 and was ongoing as of September 22, and Gambit reconstructed it after gaining access to the attacker's staging server.[0]
Documented impact includes more than 600,000 valid credit card records stolen from two companies, credit card skimmers deployed across at least 119 websites, and breaches of a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor, and an online fashion retailer. In a single five-day window the operator compromised at least 27 companies, and between September 10 and 15 launched 105 distinct attack waves.[0]
The operator gave the AI agents brief instructions and let them handle the attack chain, achieving access in just a few hours in many cases. A Hermes skill file directed the agent to wipe source card fields from Magento databases after exfiltration, which caused destructive data losses and operational disruptions at several retailers — meaning defenders must plan for data loss as a side effect of the attacker's cleanup routine.[0]
Attack chain
- Target selection: The operator used a website traffic-ranking service to find valuable targets from the list Strix produced, prioritizing organizations running custom software because they were presumed more likely to be vulnerable.[0]
- Vulnerability discovery (Strix): Strix, an open-source penetration testing framework, was used for scanning and vulnerability discovery, running 146 times against 138 hosts between August 23 and 31 and accumulating 633 scanning hours.[0]
- Autonomous exploitation (Cairn): Cairn, an autonomous exploitation engine, was tasked with objectives such as obtaining a shell or admin access, running largely on its own based on short operator instructions.[0]
- Orchestration and post-exploitation (Hermes): Hermes handled campaign orchestration, post-exploitation, and tactical decisions using claude-opus-4.6, loaded with a 'SOUL - Red Team Operator' persona and 121 skills including 78 attack-related skills.[0]
- Skimmer injection and persistence: Skimmers were injected using methods that varied by access level, identified vulnerabilities, and architecture: appending malicious code to legitimate JavaScript files, adding script tags to checkout pages or Google tag blocks, poisoning S3/CDN content and server-side caches, modifying database fields, altering Kubernetes deployments, and using cron jobs to restore the skimmer after removal.[0]
- Card data exfiltration and destruction: After extracting and downloading card data, the agent wiped the source fields in batches from Magento databases per a Hermes skill file, causing operational disruptions at several retailers due to data losses.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 2026 | Campaign activity begins; the attacker uses open-source AI agent frameworks against online retailers.[0] |
| August 23-31, 2026 | Strix run 146 times against 138 hosts, accumulating 633 scanning hours.[0] |
| August 25, 2026 | Captured OpenRouter account records $7,005.71 spent over roughly four weeks.[0] |
| September 10-15, 2026 | Operator launches 105 distinct attack waves, succeeding to varying degrees on at least 27 companies.[0] |
| September 22, 2026 | Campaign reported as still ongoing.[0] |
| September 23, 2026 | BleepingComputer publishes coverage of Gambit's findings.[0] |
Actor profile
Unnamed financially motivated operator (Gambit)
A single human operator, who appears to be Chinese, gave the AI agents brief instructions on the operation's goals and let them autonomously execute the attack chain. The operator is financially motivated, focused on credit card theft and skimmer deployment against online retailers, and used a website traffic-ranking service to prioritize high-value targets running custom software. Tooling included a Hermes persona named 'SOUL - Red Team Operator' with 121 skills. No named APT or public alias is attributed in the evidence.[0]
How it works
Rather than exploiting a single fixed flaw, the operator chained open-source AI tooling: Strix scanned for and discovered vulnerabilities, Cairn autonomously exploited targets to gain a shell or admin access, and Hermes orchestrated post-exploitation and tactical decisions. Ultimate card theft targeted Magento retailers, from which card data was extracted and then wiped from the source database fields.[0]
Skimmer delivery depended on the level of access and site architecture, and included appending malicious code to legitimate JavaScript files, adding script tags to checkout pages or Google tag blocks, poisoning S3/CDN content and server-side caches, modifying database fields, altering Kubernetes deployments, and using cron jobs to re-establish the skimmer after removal.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Magento-based online retailers running custom software | Online retailers, prioritized where they ran custom software; Magento databases storing card data were targeted for extraction and wiping | No single patch; the article describes an ongoing campaign against many retailers rather than one CVE[0] |
Key takeaways
- Open-source autonomous AI agent frameworks have driven the marginal cost of compromising a retailer down to a mean of about $25 per company (from $3.13 to $79.31 across 101 completed scans), lowering barriers so that even less-skilled actors can run large-scale campaigns.[0]
- Destructive data loss can occur as a side effect of AI-driven attacker cleanup routines, so rapid recovery and resilience, not only patching, are essential defensive measures against this class of campaign.[0]
Defensive actions
- Plan for potential data loss as a side effect of the attacker's cleanup routine, not just data theft.: A Hermes skill file instructed the agent to wipe source card fields in batches after extraction, which caused operational disruptions and data losses at several retailers.[0]
- Inspect checkout-page and library JavaScript for appended loaders and foreign script tags, and review S3/CDN content, server-side caches, database fields, and Kubernetes deployments for injected skimmer code.: Skimmers were injected via multiple methods including appending code to legitimate JavaScript, adding script tags to checkout pages or Google tag blocks, poisoning S3/CDN and server-side caches, modifying database fields, and altering Kubernetes deployments.[0]
- Hunt for persistence such as cron jobs that re-inject skimmers after they are removed.: The attacker used cron jobs to restore the skimmer after it was removed.[0]
- Calibrate detection, change windows, and response for machine-speed attacks that achieve access within hours.: Access was often obtained in just a few hours, with AI tools doing the work at scale based on short operator instructions and at a marginal cost of tens of dollars per company.[0]