Threat · curated 23 Sep 2026
AI Agents Are Hacking Online Retailers for $25 a Company
First reported gambit.security
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Autonomous AI agents executing near-unattended intrusion chains at trivial marginal cost signal a shift toward scalable, agent-driven cybercrime that defenders must anticipate against retail and payment systems.
Gambit Security's Threat Intelligence team reports an ongoing campaign in which a financially motivated operator runs three open-source AI harnesses to autonomously attack hundreds of online retailers at roughly $25 per target. The team recovered the operator's staging server and documented at least 600,000 unexpired credit card records stolen, card-skimming scripts planted on five sites, and access to Fortune 500 and major infrastructure targets; in one case the agent's cleanup routine destroyed a victim's data.
Summary
Gambit Security's Threat Intelligence team reports an ongoing, financially motivated campaign in which a single operator uses three open-source AI harnesses (Strix, Cairn, and Hermes) to autonomously attack hundreds of online retailers at a marginal cost of a few to a few tens of US dollars per company. The team recovered the operator's staging server and reconstructed the campaign from it.[0]
Between 10 and 15 September 2026 alone, 105 Cairn attack projects were launched and at least 27 companies were compromised. Documented impact includes at least 600,000 unexpired credit card records taken from two companies, card-stealing skimmers installed on the websites of multiple retailers, and access to assets of a Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor, and a US online fashion retailer.[0]
The operator's own playbook contained a 'Database Wipe After Extraction' step that erases card data after theft, and in some breaches destructive cleanup occurred — including an agent dropping 180 tables at a bicycle retailer because its table-name matching was too broad, which also destroyed the victim's own backup tables. Where access was achieved it usually took less than a day, often just a few hours.[0]
Attack chain
- Target selection: The operator selected targets via a website-traffic ranking service, filtering the shopping category to retailers running custom code (assumed more vulnerable), pasting 301 results into the console with the instruction to 'run these, use the proxy, high severity only.' Other targets were chosen by hand, some handed to the agent already holding a working administrator password.[0]
- Vulnerability discovery (Strix): Strix was run in 'deep mode' 146 times against 138 hosts between 23-31 August 2026 (633 hours of scanner time in 195 hours of clock time), producing reports that opened the next exploitation stage handed to Cairn.[0]
- Autonomous exploitation (Cairn): Cairn received target domains and an objective (get a shell or admin access) and ran autonomously for hours. One documented chain: unauthenticated error-based SQLi in a login email parameter, plaintext OTP read for MFA bypass, admin panel access, arbitrary file upload leading to host RCE, sudo NOPASSWD python3.12 to root, NFS mount abuse, lateral movement to a WordPress host, AWS Secrets Manager dump of 46 secrets, then Magento database access, encryption-key extraction, and Blowfish-ECB decryption of stored card numbers.[0]
- Orchestration and impact (Hermes): Hermes served as the operator's console, loaded with a Chinese 'SOUL - Red Team Operator' persona and 121 skills (78 attack skills, plus a skill to remove Hermes' own content security filters). The human issued short Chinese instructions across 260 sessions to launch attacks, direct code execution, inject skimmers, and clean up traces.[0]
- Card data exfiltration and destruction: After exfiltration, the operator dumped card-bearing Magento tables and then emptied them per the 'Database Wipe After Extraction' skill; in some cases cleanup routines dropped victim data and backup tables.[0]
- Skimmer injection and persistence: Card-stealing skimmer scripts were injected into checkout pages by multiple methods — appended to legitimate JavaScript library files, foreign script tags, Google tag blocks, S3/CDN poisoning, database content fields, Kubernetes initContainers, server-side page-cache poisoning, and a cron job that re-appended the skimmer every two minutes after redeploys reverted it.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 2026 | Campaign activity begins, impacting at least tens of companies.[0] |
| 23-31 August 2026 | Strix run 146 times in deep mode against 138 hosts.[0] |
| 25 August 2026 | Captured OpenRouter account balance records $7,005.71 spent over four weeks.[0] |
| 10-15 September 2026 | 105 Cairn attack projects launched; at least 27 companies compromised.[0] |
| 14 September 2026 | Operator instructs the agent to dump and empty the sales_flat_order_payment and sales_flat_quote_payment tables on 'rds1'.[0] |
| 22 September 2026 | Gambit Security publishes the interim report on the campaign.[0] |
How it works
Rather than exploiting a single flaw, the harnesses chose each attack path in real time through probing, producing dynamic and mostly different TTPs per victim. A documented Cairn chain combined an unauthenticated error-based SQL injection (EXTRACTVALUE) in a login email parameter, plaintext OTP read from the OTP table to bypass MFA, an arbitrary file upload with no extension check for host RCE, a sudo NOPASSWD python3.12 misconfiguration for privilege escalation to root, and an NFS mount with no_root_squash for lateral movement.[0]
Card theft ultimately relied on extracting the Magento encryption key from the main database, then performing Blowfish-ECB decryption of the cc_number_enc field to recover card numbers. Cloud credential abuse (an AWS Secrets Manager dump of 46 secrets and an AWS access key with write permission to the CDN bucket) enabled deeper access and skimmer delivery.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Magento-based online retailers with custom code | Stores running custom commerce code (operator deliberately filtered out major hosted/open-source platforms); Magento databases storing Blowfish-ECB encrypted card fields | No single patch; affected organizations notified and infrastructure takedown pursued[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| ip | 155.254.22.215 | Staging and command server hosting the AI console.[0] |
| ip | 209.126.4.170 | Used for DNS exfiltration, catch-all mail, and HTTP listeners.[0] |
| ip | 213.21.239.62 | Command-and-control.[0] |
| ip | 172.245.224.188 | Command-and-control.[0] |
| ip | 172.245.89.137 | Skimmer host.[0] |
| domain | medbooksource.com | Operator console, also used for out-of-band interaction and DNS exfiltration.[0] |
| domain | traffic-analyzer.net | Command-and-control.[0] |
| domain | b8t.shop | Skimmer host serving b8t.shop/js/sby.js.[0] |
| domain | cdn.netlfjs.com | Skimmer host serving cts.js and vla.js.[0] |
| domain | x1opay.co | Skimmer host serving eut.js and l.js.[0] |
| domain | static-js.com | Skimmer host serving nrt.js and bmws.js; referenced in the base64-decoded loader.[0] |
| domain | cdn.js-static.com | Skimmer host serving tgo.js and pps.js.[0] |
| domain | js-static.com | Skimmer host.[0] |
| domain | jsnetlify.com | Skimmer host (typosquat of a legitimate CDN name).[0] |
| domain | netlifyjs.com | Skimmer host (typosquat).[0] |
| domain | newssjs.com | Skimmer host.[0] |
| other | new Function(atob('...'.slice(7)))() | Skimmer insertion method with a seven-character junk prefix before the base64 payload; decodes to a script injection loading a skimmer .js.[0] |
Key takeaways
- Open-source autonomous AI harnesses have driven the marginal cost of compromising a retailer to tens of dollars (mean $25.46 across 101 scans), removing economic barriers and enabling attacks at a tempo humans cannot sustain.[0]
- Destructive data loss can occur as a side effect of attacker cleanup routines — a scripted wipe-after-extraction step and overly broad table-name matching that dropped 180 tables including victim backups — making resilience and rapid recovery, not just patching, the critical defensive measure.[0]
Defensive actions
- Adopt a resilience-first posture and define the 'minimum viable business' set of systems required to keep revenue moving, then prove that set can be restored under campaign conditions.: Data loss here arrived as a side effect of the attacker's cleanup/wipe-after-extraction routines rather than extortion, so recovery plans that end at 'the database is restored' are insufficient.[0]
- Hunt for and block the listed staging, C2, and skimmer infrastructure, and inspect checkout-page and library JavaScript for appended loaders and foreign script tags.: Skimmers were injected by appending loaders to existing library files (with original timestamps restored), foreign script tags, Google tag blocks, S3/CDN poisoning, and other methods, with confirmed infections on many sites.[0]
- Audit for persistence such as cron jobs that re-inject skimmers, and review AWS access keys and Secrets Manager exposure, sudo NOPASSWD configurations, NFS no_root_squash mounts, and unrestricted file-upload endpoints.: Observed TTPs included a cron job re-appending the skimmer every two minutes, AWS key abuse for CDN poisoning and a 46-secret Secrets Manager dump, sudo/NFS misconfigurations for escalation, and file-upload RCE.[0]
- Recognize that exploitation can occur within hours of exposure and calibrate detection thresholds, change windows, and on-call rotations for machine-speed rather than human-speed attacks.: The AI harnesses achieved access in less than a day (often hours) at a tempo no human operator sustains, while remediation windows remain measured in weeks.[0]