Cybersecurity researchers at Gambit have uncovered a large-scale campaign in which a financially motivated attacker leverages open-source AI agent frameworks to compromise online retailers and extract payment card data. The operation has persisted since at least July and remained active through mid-September, with attackers breaching at least 27 organizations within a single five-day window and executing over 100 separate attack attempts.
Analysis by Gambit indicates that the threat actor obtained more than 600,000 valid card records from two targeted companies alone, while also deploying skimmer malware across the websites of five additional organizations. The campaign ultimately compromised at least 119 websites with payment-stealing code, affecting major corporations including a Fortune 500 hospitality chain, a major U.S. carrier, a large industrial supplies distributor, and a prominent online fashion merchant.
Three AI Tools Power the Attack Chain
The attacker orchestrates the campaign using three distinct AI-powered tools, each handling a specific phase of the assault:
- Strix — a penetration testing framework designed for vulnerability scanning and discovery
- Cairn — an autonomous exploitation engine tasked with obtaining shell access or administrative privileges
- Hermes — handles campaign coordination, post-breach activities, tactical decisions and overall direction of malicious operations using claude-opus-4.6
Between August 23 and 31, Strix executed 146 scanning operations against 138 hosts, consuming 633 hours of scanning activity. Hermes contained a persona labeled "SOUL - Red Team Operator" and included 121 distinct skills, of which 78 were attack-focused.
The human operator, believed to be based in China, provided the AI agents with high-level objectives and allowed the systems to execute the remainder of the attack autonomously. Between September 10 and 15, the attacker launched 105 separate attack waves, achieving varying levels of success across at least 27 targets.
Injection Methods and Data Destruction
Attackers deployed skimmers using multiple techniques tailored to the specific access level, identified weaknesses, and system architecture of each target. Documented injection methods included:
- Appending malicious code to legitimate JavaScript files
- Inserting script tags into checkout pages or Google tag manager blocks
- Poisoning S3 and CDN content alongside server-side caches
- Modifying database records
- Altering Kubernetes deployments
- Using cron jobs to restore skimmers after removal
Researchers discovered that the attacker instructed Hermes to execute cleanup routines that removed card data from Magento databases following exfiltration. One skill file contained the directive: "After extracting and downloading all card data, wipe the source fields in batches." This practice caused operational disruptions at several retailers due to unintended data loss.
Low per-target costs
Gambit researchers obtained access to an OpenRouter account used by the attacker, revealing spending of $7,005.71 over approximately four weeks as of August 25. Extrapolating from subsequent usage patterns, researchers estimate total operational costs between $12,000 and $18,000, translating to an average of $25 per targeted organization.
Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company
Gambit researchers
The operator's own cost tracking showed similar figures, with a mean expenditure of $25.46 across 101 completed scans, ranging from $3.13 for the least expensive target to $79.31 for the costliest.
Researchers emphasize that the combination of automation and minimal per-target expenses enables even less sophisticated threat actors to execute such campaigns. In numerous cases, initial access was obtained within hours, with AI systems performing the exploitation work based on brief instructions provided by the operator between autonomous execution cycles.
Gambit warns that organizations developing defenses against this attack pattern should also prepare for potential data loss as an unintended consequence of the attacker's data-wiping procedures.