Malicious AI Agents Stole More Than 600,000 Credit Cards and Infected 119 Retail Websites

Financially motivated attackers used an open-source AI agent framework to automate attacks against hundreds of online retailers, stealing more than 600,000 valid credit card records and deploying payment skimmers on at least 119 websites.

The campaign has been active since at least July and was still ongoing as of September 22. During a five-day period, the attackers compromised at least 27 companies and launched more than 100 attack waves.

According to findings from cybersecurity startup Gambit, the attackers stole more than 600,000 valid card details from two companies. They also infected the websites of at least five other organizations with skimmer malware designed to collect payment data.

Researchers say the campaign used three AI-powered tools to conduct attack operations against dozens of companies each day:

• Strix: A penetration-testing framework used for scanning and vulnerability discovery.
• Cairn: An autonomous exploit engine used for tasks such as gaining shell or administrative access. It is not related to Cisco Talos’s AI malware-analysis tool of the same name, which was released the previous day.
• Hermes: An agent used for campaign orchestration, post-exploitation activity, tactical decisions, and directing malicious operations. Researchers noted that Claude works with Hermes 4.6.

AI agents automated reconnaissance and exploitation

Gambit researchers found that Strix ran 146 times against 138 hosts between August 23 and 31, accounting for 633 hours of scanning.

Hermes included a persona called “SOUL – Red Team Operator” and 121 skills, 78 of which were related to offensive security activities.

The researchers said the human operator, believed to be Chinese, provided the AI agent with brief instructions describing the operation’s objectives and left much of the execution to the agent.

Between September 10 and 15, the attackers reportedly launched 105 separate attack waves, achieving at least 27 successes of varying severity.

Attackers used multiple techniques to deploy credit card skimmers

The attackers injected payment skimmers into targeted websites using different techniques, depending on their level of access, the vulnerabilities they identified, and each organization’s architecture.

Observed methods included:

• Adding malicious code to legitimate JavaScript files
• Inserting script tags into checkout pages or Google Tag blocks
• Poisoning S3 and CDN content
• Poisoning server-side caches
• Modifying database fields
• Changing Kubernetes deployments
• Using cron jobs to restore skimmers after removal

Gambit researchers gained access to a staging server operated by the attackers, allowing them to obtain first-hand evidence of the campaign.

In total, at least 119 websites were compromised with credit card skimmers. The victims included a Fortune 500 service company, a major U.S. airline, a major U.S. industrial supply company, and an online fashion retailer.

The attackers used a website traffic-ranking service to identify valuable targets from the organizations listed by Strix. They prioritized companies running custom software, which researchers believe may have been viewed as more likely to contain exploitable vulnerabilities.

AI agent was instructed to delete stolen card data

During the investigation, Gambit researchers discovered that the attackers instructed the AI agent to perform cleanup operations after compromising Magento stores. These actions removed card data from the Magento database.

The instruction appeared in one of Hermes’s skill files: “After extracting and downloading all card data, we will clean the source fields in batches.”

Researchers said these cleanup operations disrupted the operations of several retailers by causing data loss in addition to the theft of payment information.

AI-powered attacks cost as little as $25 per target

Gambit also gained insight into the cost of operating the campaign. An OpenRouter account used by the attackers showed $7,005.71 in spending over approximately four weeks as of August 25.

Based on later usage, researchers estimate that the total cost of the operation reached between $12,000 and $18,000. That translates to an average cost of approximately $25 per target.

“It spreads across the attacked enterprise, with marginal costs ranging from a few dollars to tens of dollars for each targeted company,” Gambit explained.

“The carriers’ own cost reviews yielded similar numbers, with an average of $25.46 for the 101 scans completed, ranging from $3.13 for the cheapest target to $79.31 for the most expensive.”

Researchers said the combination of automation and low operating costs could allow less-skilled attackers to launch similar campaigns. In many cases, access was obtained within a few hours, with AI tools carrying out tasks based on short instructions provided by operators between autonomous runs.

Gambit warned that organizations defending against autonomous AI attacks must prepare not only for data theft, but also for data loss caused by automated cleanup activities after a breach.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a two-hour digital summit about AI-speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat