AI Agent Campaign Compromises 119 Retail Sites and Steals Over 600,000 Card Records
Summary
Gambit researchers report that a financially motivated actor used AI agent frameworks to compromise at least 119 websites, steal over 600,000 card records from two companies, and disrupt some retailers through cleanup procedures.
Key points
- The campaign has been active since at least July and was ongoing as of September 22, according to the report.
- Gambit found evidence that Strix, Cairn, and Hermes were used for scanning, exploitation, and campaign orchestration.
- The actor reportedly stole more than 600,000 valid card records from two companies and deployed skimmers on at least 119 websites.
- Skimmers were inserted through methods including modifying JavaScript, checkout pages, databases, cloud-hosted content, and Kubernetes deployments.
- Researchers say the actor instructed an AI agent to remove card data from Magento databases after exfiltration; the cleanup reportedly caused data loss and operational disruptions at several retailers.
- Gambit researchers estimated campaign costs of $12,000–$18,000, with an average of about $25 per target.
Article Details
- Victim Organization
- Unknown
- Incident Type
- Automated attacks against online retailers involving website compromise, payment-card skimming, and theft of card data
- Data Types Exposed
- Credit card details
- Affected Records
- More than 600,000 valid credit card records reportedly stolen from two companies
- Operational Impact
- Researchers reported operational disruptions at several retailers after card data was removed from Magento databases during the attackers' cleanup procedures.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Products
Tools
CairnThe campaign, active since at least July, has compromised at least 119 websites with card skimmers and relied on Strix, Cairn, and Hermes to carry out scanning, exploitation, and orchestration at scale.HermesThe campaign, active since at least July, has compromised at least 119 websites with card skimmers and relied on Strix, Cairn, and Hermes to carry out scanning, exploitation, and orchestration at scale.StrixThe campaign, active since at least July, has compromised at least 119 websites with card skimmers and relied on Strix, Cairn, and Hermes to carry out scanning, exploitation, and orchestration at scale.
Industries
airlineairline, a large U.S. industrial supplies distributor, and an online fashion retailer.HospitalityIn total, the campaign has compromised at least 119 websites with credit card skimmers, and the threat actors breached large organizations such as a Fortune 500 hospitality company, a major U.S.Industrial suppliesindustrial supplies distributor, and an online fashion retailer.