A financially motivated threat actor is using open-source artificial intelligence agent frameworks to attack hundreds of online retailers at scale. This ongoing campaign has stolen more than 600,000 credit card records. Cybersecurity startup Gambit discovered the activity, which has been active since at least July and continued through September 22.
During a five-day window, the threat actor compromised at least 27 companies and launched over 100 attacks. Findings from Gambit show that the attacker stole more than 600,000 valid card details from two companies. The actor also deployed skimmer malware on the websites of five other organizations to collect payment data.
The researchers report that the campaign is powered by three artificial intelligence tools to execute the attack chain against tens of companies every day. One tool named Strix ran 146 times against 138 hosts between August 23 and 31. This accumulation totaled 633 scanning hours. Another tool named Hermes contained a persona called SOUL - Red Team Operator alongside 121 skills, including 78 attack-related skills.
A human operator, who appears to be Chinese, provided the artificial intelligence agents with brief instructions regarding the operation's goals. The operator then let the agents handle the rest of the work. Between September 10 and 15, the attacker launched 105 distinct attack waves. These attempts succeeded to varying degrees on at least 27 targets.
Skimmers were injected into target websites using several different methods. These techniques depended on access levels, identified vulnerabilities, and architecture. Observed methods included appending malicious code to legitimate JavaScript files, adding script tags to checkout pages, and poisoning S3 or CDN content. Attackers also poisoned server-side caches, modified database fields, altered Kubernetes deployments, and used cron jobs to restore skimmers after removal.
Gambit researchers gained access to a staging server operated by the attacker and retrieved direct evidence. In total, the campaign compromised at least 119 websites with credit card skimmers. The threat actors successfully breached large organizations including a Fortune 500 hospitality company, a major United States airline, a large industrial supplies distributor, and an online fashion retailer.
The attacker used a website traffic-ranking service to find valuable targets from the list produced by Strix. They prioritized companies running custom software because those systems were presumably more vulnerable. During the investigation, researchers found that the attacker instructed the artificial intelligence agent to run cleanup procedures that removed card data from Magento databases after exfiltration.
The instruction appears explicitly in one of the Hermes agent skill files, directing the system to wipe source fields in batches after extracting and downloading all card data. This cleanup caused operational disruptions at several retailers due to data losses. Gambit researchers also gained insight into the financial costs required to run this operation.
An OpenRouter account showed 7,005 dollars and 71 cents spent over roughly four weeks as of August 25. Based on subsequent usage, researchers estimate total costs between 12,000 and 18,000 dollars. This calculates to an average cost of 25 dollars for each target.
Gambit explains that this marginal cost of a few dollars to a few tens of dollars for each targeted company makes automation accessible. The operator own cost review gave a similar figure with a mean of 25 dollars and 46 credits over 101 completed scans. The cheapest target cost 3 dollars and 13 cents, while the most expensive cost 79 dollars and 31 cents.
The researchers note that automation and low costs make it easy for threat actors, including less skilled individuals, to deploy such attacks. In many cases, access was obtained in just a few hours. The artificial intelligence tools executed the work based on short instructions provided by the operator between autonomous runs.
Gambit warns that organizations looking to defend against this specific type of attack should also plan against potential data loss. Data loss frequently occurs as an unintended side effect of the attacker automated cleanup routine. The campaign remains ongoing as security analysts continue to track the threats.
