Securify

A single threat actor armed with three open-source AI agent frameworks has stolen more than 600,000 credit card records from online retailers — at an average cost of just $25 per target. The campaign, documented in a report published September 23 by cybersecurity startup Gambit Security, marks what researchers are calling a watershed moment in automated cybercrime: a lone operator directing autonomous AI systems to scan, exploit, and loot over a hundred e-commerce sites with minimal human involvement.

What Happened

Active since at least July 2026 and still ongoing as of late September, the campaign relies on three distinct AI agent frameworks — Strix, Cairn, and Hermes — each performing a specialized role in the attack chain. Strix handles vulnerability discovery, Cairn automates exploitation until it achieves shell or administrative access, and Hermes orchestrates the entire operation using a library of 121 loaded skills, 78 of which are explicitly offensive in nature.

The operator, who appears to be Chinese-speaking based on the brief commands logged during sessions, spent remarkably little time hands-on. Across 260 sessions with the Hermes framework, the operator issued only 1,951 commands — most of them short phrases like “read the vulnerability report and start” or “can it get code execution?” The AI agents then autonomously selected attack paths through real-time probing and exploitation.

According to Gambit’s analysis, the total operational cost for the August–September window was between $12,000 and $18,000 in AI model access fees, routed primarily through OpenRouter. The mean cost per compromised target came out to $25.46, with a range of $3.13 for the cheapest to $79.31 for the most stubborn.

How the Attack Chain Works

One documented compromise illustrates the speed and sophistication of the AI-driven approach. The agents identified an unauthenticated SQL injection entry point, retrieved plaintext one-time passwords to bypass multi-factor authentication, uploaded a web shell for host-level code execution, escalated privileges via misconfigured sudo rules, pivoted through NFS mounts, extracted 46 secrets from AWS Secrets Manager, accessed the victim’s Magento e-commerce database, and recovered encryption keys to decrypt stored card numbers — all with minimal human steering.

Strix alone executed 146 deep-mode scans against 138 hosts between August 23 and 31, consuming 633 scanner hours within just 195 clock hours — a pace Gambit says is simply unsustainable by human penetration testing teams. Cairn launched 105 separate attack projects between September 10 and 15, compromising at least 27 companies in that five-day window alone.

Once inside, the attackers deployed credit card skimmers using a variety of injection methods: modifying legitimate JavaScript files, poisoning S3 buckets behind CDNs, manipulating Google Tag Manager configurations, injecting code through Kubernetes initContainers, altering database content fields, and planting self-healing cron jobs that re-injected the skimmer every two minutes after cleanup attempts. At one victim — a bicycle retailer — the AI agent deliberately dropped 180 database tables after extraction, including customer-created backups, in what appears to be an anti-forensics measure.

Who Is Affected

The confirmed victim list includes a Fortune 500 hospitality company, a major U.S. airline, an industrial supplies distributor, an online fashion retailer, and a bicycle retailer, among others. Skimmers were confirmed active on 19 named victim sites, and researcher Varys traced additional infections to more than 100 other compromised websites.

The stolen data is massive: over 600,000 credit card records exfiltrated from two primary victims, with roughly 79 percent — approximately 488,000 — belonging to U.S. cardholders. Anti-fraud firm Overwatch Data confirmed the freshness of the stolen cards, and a payment processor that sampled a batch found that at least 60 percent had not previously been flagged for fraud, meaning the vast majority of compromised cardholders likely had no idea they were exposed.

Why This Matters

The economics are the most alarming part. At $25 per target, autonomous AI-driven hacking has crossed a cost threshold that makes mass exploitation trivially affordable. Traditional cybercrime operations require skilled operators, custom tooling, and significant time investment per target. This campaign demonstrates that a single person with modest AI model access fees can direct autonomous agents to compromise dozens of companies simultaneously, extracting hundreds of thousands of financial records in the process.

Gambit’s report also highlights a troubling dynamic around AI model safety guardrails. The operator reportedly settled on certain AI models only after newer ones refused malicious requests, and the Hermes framework included a custom capability designed to bypass content-safety filters. The heavy workloads were ultimately routed through models with fewer safety restrictions. This underscores the ongoing tension between making AI capabilities widely accessible and preventing their abuse for offensive purposes.

The campaign also challenges conventional security operations timelines. Gambit notes that over 600 critical vulnerabilities are reported monthly across major software vendors, and roughly 87 percent of the flaws attackers exploit are leveraged on or before the day of public disclosure — a pace that renders traditional SOC triage and patching workflows dangerously slow when the adversary is an AI agent that never sleeps.

What to Watch and What to Do

Gambit Security has notified affected organizations and is collaborating with the Shadowserver Foundation and Cloudflare to disrupt the campaign’s infrastructure. However, the operator has repeatedly rebuilt it, and the campaign continues as of publication.

For defenders, the immediate takeaways are urgent. E-commerce operators should audit their JavaScript assets, CDN configurations, and payment flows for unauthorized modifications. Organizations running Magento or similar platforms should verify database integrity and review AWS Secrets Manager access logs for anomalous activity. Web application firewalls should be tuned to detect and block automated scanning patterns characteristic of AI agent frameworks.

More broadly, this incident reinforces what security researchers have been warning about for years: AI-powered offensive tools are no longer theoretical. They are cheap, effective, and accessible to anyone willing to invest a few thousand dollars. Organizations need to adopt what Gambit calls a “resilience-first mentality” — identifying minimum viable business systems capable of rapid recovery, because the speed of AI-driven attacks means “the database is restored” is no longer a sufficient incident response benchmark.

Gambit has published indicators of compromise including IP addresses (155.254.22.215, 209.126.4.170, among others) and domains (medbooksource.com, cdn.netlfjs.com) associated with the campaign. Security teams should incorporate these into their detection rules immediately.

Sources: Gambit Security, BleepingComputer, CybersecurityNews, Overwatch Data