Researchers Say AI-Driven Campaign Compromised at Least 27 E-Commerce Companies
Summary
Gambit Security says an attacker used AI tools to target 105 e-commerce sites in five days, compromising at least 27 and stealing 600,000+ card records from two. In a Silverfort lab test, stronger access controls stopped an agent that reached domain control in eight min
Key points
- Gambit Security says a Chinese-speaking attacker used three AI harnesses over five days in September to target 105 e-commerce sites; at least 27 were compromised.
- According to Gambit, attackers stole at least 600,000 payment-card records from two companies, installed skimmers on five sites, and gained some illicit access to others.
- Gambit estimated the attackers' average cost at $25.46 per completed target and identified Hermes, Strix, and Cairn among the tools used.
- In a Silverfort lab test, an orchestrating agent using publicly available Claude Opus reached complete domain control in eight minutes at a cost of about $12.
- Silverfort researchers said improved authentication and access controls caused the same agent to hit 21 dead ends and give up; suggested priorities include overprivileged accounts, reused credentials, and unmanaged service accounts.
- Flashpoint reported that average sold initial-access prices fell from just over $1,400 to $429, while ransomware activity grew 45%; it said 28% of companies paid ransoms in the first half of 2026.
Article Details
- Event Type
- AI-enabled cyberattack campaign targeting e-commerce websites, alongside a separate lab demonstration of autonomous AI-assisted compromise.
- Impact
- According to Gambit Security, over five days in September, an attacker targeted 105 e-commerce sites and compromised at least 27 companies. The campaign reportedly stole at least 600,000 payment card records from two companies, installed credit-card skimmers on five websites, and gained some degree of illicit access to other targets. Gambit Security estimated an average cost of $25.46 per completed target. Separately, Silverfort researchers reported that an AI agent achieved domain control in an eight-minute lab test; this was a test, not a reported victim incident.
People
Albert ZieglerChief information security officer at XBOW; commented on exposure to attacks and the need to harden internet-connected systems.Colin FerrisThreat hunting and incident response lead at Silverfort; described Silverfort’s lab test of autonomous AI-assisted compromise.Ian GrayVice president of intelligence for Flashpoint; discussed reported initial-access pricing and AI’s effect on attack operations.Sa’ar EliasCo-founder and chief research officer for Gambit Security; described the campaign and its reported scale and cost.
Vendors
Flashpointaccess declined from just over $1,400 to $429, according to figures from threat intelligence firm Flashpoint. While fewer companies are paying ransoms — 28% in the first half of 2026 — ransomware activityGambit Securitydegree of illicit access to the rest, which includes at least one Fortune 500 company, according to Gambit Security, which discovered the campaign.SilverfortIn another instance, researchers with AI cyber-defense firm Silverfort conduct lab tests using an orchestrating agent and publicly available versions of Claude Opus to explore how quickly autonomous AI can turn initial
Products
Tools
Cairncyberattackers used the agentic AI system Hermes and two AI penetration-testing frameworks, Strix and Cairn, according to Gambit Security.Hermesways to defend and harden systems. In the latest campaign, cyberattackers used the agentic AI system Hermes and two AI penetration-testing frameworks, Strix and Cairn, according to Gambit Security.Strixcampaign, cyberattackers used the agentic AI system Hermes and two AI penetration-testing frameworks, Strix and Cairn, according to Gambit Security.