One operator ran 105 AI-driven attack waves in five days at about $25 a company
Gambit says a single actor pointed the Strix, Cairn and Hermes agent frameworks at online retailers from July onward, taking more than 600,000 valid card records from two victims and leaving skimmers on 119 sites.
The Watch · Security desk
What happened
- Gambit says a financially motivated actor has been using open-source AI agent frameworks to attack hundreds of online retailers at scale, taking more than 600,000 credit card records.
- The campaign has run since at least July and was still active on September 22, according to the researchers.
- In one five-day stretch the actor launched more than 100 attacks and compromised at least 27 companies.
- At least 119 websites carry the skimmer, and the victims include a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor and an online fashion retailer.
- An OpenRouter account tied to the operation showed $7,005.71 spent in roughly four weeks to August 25; Gambit puts the full campaign at $12,000 to $18,000, about $25 per target.
Why it matters
- What it costs cost The cheapest completed scan cost $3.13, so spend no longer decides which companies get looked at: a mid-size retailer sits in the same queue as the airline.
- Who's exposed exposure The wipe step turns a card breach into a data recovery job for the victim, because the agent deletes the source fields in the retailer's own Magento database after exfiltrating them.
- What it limits constraint Cron-based reinstallation means pulling the skimmer off a checkout page is not remediation; whoever cleans without finding the scheduler will be cleaning again.
- What's now possible capability One person issuing short goal statements between autonomous runs sets the pace, so attacker head-count stops predicting the attack volume a defender has to absorb.
Next story · Invest · 2d ago
OpenAI edges past Anthropic in OpenRouter spend for the first time since February 2024Confirmed3 publishers
Each tool had one job. Strix handled discovery, running 146 times against 138 hosts between August 23 and 31 and accumulating 633 scanning hours [8]. Cairn took objectives such as obtaining a shell or admin access and worked them autonomously [6]. Hermes ran the campaign: orchestration, tactical decisions, post-exploitation, directed by claude-opus-4.6 [7]. Its skill library held 121 entries, 78 of them attack-related, under a persona called "SOUL - Red Team Operator" [9].
Those 633 hours sit inside a nine-day window containing 216 hours of wall clock, so Strix averaged close to three scans running at once, continuously [25].
Gambit says the operator fed the Strix output through a website traffic-ranking service and prioritized companies running custom software, on the assumption that custom code was likelier to be vulnerable [14]. Skimmer delivery then varied with whatever access Cairn won: code appended to legitimate JavaScript files, script tags added to checkout pages and Google tag blocks, poisoned S3/CDN content and server-side caches, modified database fields, altered Kubernetes deployments [12].
The card theft was concentrated. Two companies produced the entire haul, and five other organizations had skimmers planted on their sites to collect payment data [4].
One Hermes skill file carries the cleanup step: "After extracting and downloading all card data, wipe the source fields in batches" [16]. The researchers found that instruction pointed at Magento databases after exfiltration [15], and say the data loss caused operational disruptions at several retailers [17]. Their advice to defenders is to plan for losing their own records as a side effect of the attacker's housekeeping [23].
On spend, Gambit wrote: "The operator's own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive" [21]. Divide the top of the researchers' total estimate by the card count and each stolen record cost about three cents in inference [27].
The 27 companies that fell came out of 105 distinct waves, so roughly one in four attempts landed to some degree [11][26]. Gambit also says access was often obtained within a few hours, with the operator supplying short instructions between autonomous runs [22].
The evidence comes from inside the operation: Gambit researchers gained access to the attacker's staging server and retrieved direct evidence [24]. All of it is one startup's investigation, and the account describes the human operator only as appearing to be Chinese, briefing the agents on goals and leaving them to it [10].
What to watch
- Whether a second research team or a payment brand corroborates the campaign independently of Gambit's staging-server access.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption62
- Hype gap+14
- Incentives62
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records.
- [2]
The campaign has been active since at least July and was ongoing as of September 22.
- [3]
In five days the threat actor compromised at least 27 companies and launched more than 100 attacks.
- [4]
Gambit's findings indicate the attacker stole more than 600,000 valid card details from two companies and deployed skimmer malware on the websites of five other organizations to collect payment data.
- [5]
Strix is a penetration testing framework used for scanning and vulnerability discovery.
- [6]
Cairn is an autonomous exploitation engine tasked with objectives such as obtaining a shell or admin access. It is not the same-name AI malware analysis tool released by Cisco Talos.
- [7]
Hermes handles campaign orchestration, post-exploitation work, tactical decisions and directs the malicious activity using claude-opus-4.6.
- [8]
Strix ran 146 times against 138 hosts between August 23 and 31, accumulating 633 scanning hours.
- [9]
Hermes contained a persona called "SOUL - Red Team Operator" and 121 skills, including 78 attack-related skills.
- [10]
The researchers report that the human operator, who appears to be Chinese, gave the AI agents brief instructions on the operation's goals, then let them handle the rest.
- [11]
Between September 10 and 15 the attacker reportedly launched 105 distinct attack waves, succeeding to varying degrees on at least 27.
- [12]
Observed skimmer injection methods include appending malicious code to legitimate JavaScript files, adding script tags to checkout pages or Google tag blocks, poisoning S3/CDN content and server-side caches, modifying database fields, altering Kubernetes deployments, and using cron jobs to restore the skimmer after it was removed.
- [13]
The campaign has compromised at least 119 websites with credit card skimmers, and the threat actors breached large organizations including a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor and an online fashion retailer.
- [14]
The attacker used a website traffic-ranking service to find valuable targets in the list Strix produced, and prioritized those running custom software, presumably because they were more likely to be vulnerable.
- [15]
Gambit researchers discovered that the attacker instructed the AI agent to run cleanup procedures that removed card data from Magento databases after exfiltration.
- [16]
"After extracting and downloading all card data, wipe the source fields in batches."
- [17]
The cleanup routine caused operational disruptions at several retailers due to data losses, the researchers note.
- [18]
Gambit found an OpenRouter account showing $7,005.71 spent over roughly four weeks as of August 25.
- [19]
Based on subsequent usage, the researchers estimate total costs between $12,000 and $18,000, an average of $25 for each target.
- [20]
"Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company," Gambit explains.
- [21]
"The operator's own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive."
- [22]
The researchers say automation and low cost make such attacks easy to deploy even for less skilled actors, and that in many cases access was obtained in just a few hours, with AI tools acting on short instructions the operator provided between autonomous runs.
- [23]
Gambit warns that organizations defending against this type of attack should also plan against potential data loss as a side effect of the attacker's cleanup routine.
- [24]
Gambit researchers gained access to a staging server operated by the attacker and retrieved direct evidence.
- [25]
633 scanning hours across the nine-day August 23 to 31 window is an average of about 2.9 Strix scans running concurrently at all times.
- [26]
27 successful compromises out of 105 attack waves is a hit rate of about 26 percent, roughly one in four.
- [27]
At the top of the $12,000 to $18,000 cost estimate, the 600,000 stolen card records cost about $0.03 each in inference spend.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMalicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
1 article · September 23, 2026
- securityweek.comAI-Powered Campaign Targets Hundreds of Online Retailers
2 articles · September 24, 2026