AI-Agent Campaign Compromises Retailers and Steals Over 600,000 Credit Cards
Summary
Gambit reports that a financially motivated actor used AI agents to attack hundreds of online retailers, stealing over 600,000 credit-card records from two companies and injecting skimmers into more than 100 websites.
Key points
- Gambit says the campaign has been active since July and compromised at least 27 companies to varying degrees during September 10–15.
- The attackers used Strix for vulnerability hunting, Cairn to launch attack projects, and Hermes for orchestration and hacking tasks.
- Gambit reports that over 600,000 unexpired credit-card records were stolen from two companies, including more than 488,000 cards from the US.
- The campaign injected skimmer scripts into online stores; Gambit and researcher Varys identified more than 100 additional infected websites.
- Skimmers were placed in several locations, including JavaScript files, database fields, an AWS S3 bucket, and checkout-page content.
- Gambit estimates an average cost of $25.46 across 101 completed scans, based on data it retrieved.
Article Details
- Event Type
- Ongoing AI-assisted cyber campaign targeting online retailers and other companies, involving vulnerability research, exploitation, data theft, and payment-card skimming.
- Impact
- Gambit reports that at least 27 companies were compromised to varying degrees during September 10–15, with the campaign affecting at least tens of additional companies since July 2026. More than 600,000 unexpired credit-card records were stolen from two companies, and skimmer scripts were found on over 100 websites. Other reported impacts include deletion of database backup tables and access to a Fortune 500 hospitality company and three US firms.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe campaign stole more than 600,000 unexpired credit-card records from two victim companies.T1053 · Scheduled Task/JobAt a US wine retailer, the operator reportedly left a cron job that checked for and restored the skimmer when it was removed.T1059 · Command and Scripting InterpreterThe operator used autonomous agents and attack skills to carry out hacking activities, including database actions and skimmer deployment.T1059.007 · JavaScriptSkimmer scripts were injected into online stores; the source describes the scripts as JavaScript.T1070.004 · File DeletionA Hermes agent skill was designed to delete stolen card data from a victim’s Magento database.T1190 · Exploit Public-Facing ApplicationThe campaign used vulnerability research and exploitation attempts to gain access to victim organizations.T1565.001 · Stored Data ManipulationThe threat actor injected skimmer scripts into online stores’ checkout pages.
People
Vendors
Products
AWS S3but the threat actors also deployed it as a script tag, inside the site’s Google tag block, in an AWS S3 bucket, in database content fields, in a Kubernetes initContainer, and in the cached page model of theDeepSeekBetween August 23 and 31, the attackers ran it 146 times in ‘deep mode’ against 138 hosts, through OpenRouter on GLM 5.2 and on DeepSeek v4 Pro.GLMBetween August 23 and 31, the attackers ran it 146 times in ‘deep mode’ against 138 hosts, through OpenRouter on GLM 5.2 and on DeepSeek v4 Pro.JBossthe application redeploy restored the clean checkout bundle, so the operator left a cron job in the JBoss log directory that checked the file size every two minutes and appended the skimmer again whenever it wasKubernetesa script tag, inside the site’s Google tag block, in an AWS S3 bucket, in database content fields, in a Kubernetes initContainer, and in the cached page model of the checkout page.MagentoThe cybersecurity firm also identified a Hermes agent skill designed to delete the stolen card data from the victim’s Magento database.OpenRouterBetween August 23 and 31, the attackers ran it 146 times in ‘deep mode’ against 138 hosts, through OpenRouter on GLM 5.2 and on DeepSeek v4 Pro.
Tools
CairnThe generated reports were then handed to the autonomous penetration testing engine Cairn, which was used to launch 105 attack projects between September 10 and 15 on DeepSeek v4.1 Flash.HermesFor the third stage of the attack, the threat actor used the open source autonomous AI agent Hermes, which has persistent memory, self-written skills, a searchable session archive, and a web console, and supportsStrixMounted by a Chinese-speaking, financially motivated threat actor, the campaign used the open source AI penetration testing tool Strix for vulnerability hunting.
Industries
airlineAdditionally, they gained some access to a Fortune 500 hospitality company and to three US firms, including an airline, a private industrial supplies distributor, and an online fashion retailer.HospitalityAdditionally, they gained some access to a Fortune 500 hospitality company and to three US firms, including an airline, a private industrial supplies distributor, and an online fashion retailer.Industrial suppliesAdditionally, they gained some access to a Fortune 500 hospitality company and to three US firms, including an airline, a private industrial supplies distributor, and an online fashion retailer.