The discovery of a financially motivated cybercrime campaign using autonomous AI agents to attack online retailers represents an important shift in the way large-scale cyberattacks can be conducted.

According to research from Gambit Security, a Chinese-speaking threat actor used multiple open-source AI agent frameworks to automate large portions of the attack lifecycle, including reconnaissance, vulnerability discovery, exploitation, persistence, post-exploitation activity, deployment of payment-card skimmers, and cleanup.

The campaign has reportedly been active since at least July 2026 and remained ongoing as of September 22.

During just five days between September 10 and 15, the attacker launched 105 separate attack campaigns and successfully compromised at least 27 organizations to varying degrees.

Researchers ultimately identified 119 websites infected with payment-card skimmers, while more than 600,000 valid credit card records were stolen from two compromised organizations.

These figures matter, but the more important development is the level of automation behind them.

Three AI systems performed different parts of the attack

The attacker used three main AI-enabled frameworks:

Strix performed reconnaissance, scanning, and vulnerability discovery.

Cairn operated as an autonomous exploitation system and was given objectives such as obtaining administrator access or establishing a shell.

Hermes orchestrated the wider campaign, made tactical decisions, performed post-exploitation tasks, and coordinated attack activity using an AI persona configured as a red-team operator.

Researchers found that Hermes contained 121 different skills, including 78 specifically related to offensive security operations.

This created something closer to an automated offensive-security team than a conventional script.

The human operator still provided goals and instructions, but much of the execution was delegated to AI systems capable of independently choosing techniques and continuing until they achieved the desired result.

Human involvement became surprisingly small

One of the most significant findings is how little direct human interaction was required.

Across 260 observed sessions, the attacker reportedly provided only 1,951 short prompts.

That means the operator did not manually perform every vulnerability scan, exploit attempt, persistence action, or website modification.

The AI agents handled much of that work autonomously.

This changes one of the traditional constraints on cybercrime: attacker time.

Historically, compromising dozens or hundreds of organizations required either a large criminal operation or substantial automation written specifically for the campaign.

Agentic AI can now provide another layer of automation that adapts dynamically to different environments.

Instead of following one fixed script, an AI agent can potentially examine the target, encounter an unexpected configuration, choose another technique, and continue.

The economics are arguably more alarming than the technical sophistication

Gambit researchers also obtained visibility into the attacker's AI-model usage costs.

An OpenRouter account associated with the operation showed more than $7,000 in spending over approximately four weeks, with total expenditure estimated at between $12,000 and $18,000.

Spread across the targets, however, the attacker was spending only around:

$25 per organization on average.

The attacker's own records reportedly showed an average cost of $25.46 across 101 completed scans, with individual targets costing as little as $3.13 and no more than approximately $79.31.

That figure may be one of the most important aspects of this entire campaign.

If an attacker can perform hours of adaptive reconnaissance and exploitation against an organization for tens of dollars, the economic threshold for targeting a company becomes dramatically lower.

Smaller organizations can no longer assume they are unattractive because manually attacking them would not be profitable.

Automation changes that equation.

The attacker could target dozens of companies simultaneously

Researchers observed the AI infrastructure attacking many organizations in parallel.

Strix alone reportedly executed 146 times against 138 hosts between August 23 and 31, accumulating approximately 633 scanning hours.

A human operator could not realistically perform that level of simultaneous interactive reconnaissance manually.

AI agents remove that bottleneck.

One attacker can now potentially supervise many parallel operations while automated systems perform the repetitive work.

This is an important transition from traditional attack automation.

Conventional vulnerability scanners already allow attackers to scan large numbers of systems.

What agentic systems add is the ability to potentially act on those findings:

identify a vulnerability → attempt exploitation → observe the result → select another path → obtain access → modify the environment → continue operating.

That adaptive loop is substantially more powerful than simply launching a scanner.

The card-skimming techniques changed depending on the environment

Once access was obtained, the agents deployed payment-card skimmers using different methods depending on the victim's architecture and privileges available.

Researchers observed techniques including:

  • appending malicious JavaScript to legitimate files;
  • inserting script tags directly into checkout pages;
  • modifying Google Tag-related content;
  • poisoning S3 or CDN-hosted resources;
  • poisoning server-side caches;
  • modifying database fields;
  • altering Kubernetes deployments; and
  • creating cron jobs that automatically restored the skimmer if defenders removed it.

This flexibility is important.

Traditional malware campaigns frequently depend on one reliable persistence or injection mechanism.

In this campaign, the attacking system could adapt the technique to the victim's architecture.

That makes simple indicator-based defenses less effective.

Removing one malicious JavaScript file may accomplish little if a cron job, database entry, container configuration, or CDN resource simply recreates it.

The campaign compromised significant organizations

The victims were not limited to small online stores.

Gambit's investigation identified compromises involving organizations such as:

  • a Fortune 500 hospitality company;
  • a major U.S. airline;
  • a large U.S. industrial-supplies distributor; and
  • an online fashion retailer.

The attacker also used a website traffic-ranking service to prioritize more valuable targets.

Interestingly, sites using custom software were reportedly prioritized because the attacker believed they were more likely to contain exploitable weaknesses.

This is a useful reminder that custom applications do not automatically provide security through obscurity.

Unique software may avoid mass scanning for known CMS vulnerabilities, but poorly maintained custom code can present equally valuable opportunities to an adaptive attacker.

More than 600,000 valid payment cards were stolen

Researchers recovered evidence showing that more than 600,000 valid credit card records were stolen from two organizations.

Separate investigations also identified skimmers deployed across over one hundred other websites, meaning the final number of stolen cards could continue increasing while those skimmers remain active.

The U.S. represented the majority of the exposed cardholder population reported by researchers, with additional affected cards linked to countries including the United Arab Emirates, Saudi Arabia, and the United Kingdom.

This illustrates the global impact of a campaign that can automatically move between targets regardless of geography.

The cleanup process actually destroyed victim data

One of the more unusual aspects of the operation was the attacker's cleanup procedure.

Hermes included instructions directing the agent to delete payment-card information from the victim's Magento database after the information had been extracted.

The instruction effectively told the system:

retrieve the data, download it, and then remove the original fields.

Researchers reported that this caused operational disruption for several affected retailers.

This is significant because defenders usually think of data theft and destructive attacks as separate categories.

In this campaign, destruction occurred as a side effect of operational security.

The attacker was not necessarily trying to operate ransomware.

The system was deleting information to remove evidence after exfiltration.

The result for the victim, however, could still be data loss.

Incident response must therefore consider integrity, not only confidentiality

Organizations responding to a breach frequently focus first on determining whether information was stolen.

This campaign shows that they must also ask whether the attacker modified or deleted data.

If an autonomous agent performs cleanup automatically, defenders may discover that databases, logs, application files, or configuration have changed before they even realize the intrusion occurred.

Incident-response planning should therefore address three independent questions:

What was accessed?

What was stolen?

What was changed or destroyed?

The third question becomes particularly important when autonomous offensive systems are instructed to erase their traces.

Traditional patching timelines are becoming inadequate

The speed of this operation creates another problem.

Gambit found that some attacks moved from initial reconnaissance to successful compromise within only a few hours.

Many organizations, meanwhile, measure vulnerability remediation in:

  • days;
  • weeks; or
  • monthly maintenance cycles.

That difference is becoming dangerous.

An attacker who can automatically identify and exploit vulnerabilities within hours may complete the intrusion before an organization's conventional remediation process even assigns the ticket.

Security programs therefore need to distinguish between ordinary vulnerability management and emergency exposure reduction.

Internet-facing vulnerabilities affecting payment platforms, administrative interfaces, cloud workloads, and customer-facing applications may require machine-speed detection and significantly faster remediation workflows.

E-commerce platforms should treat checkout integrity as a critical control

Card-skimming attacks succeed because malicious JavaScript is executed inside pages where customers enter payment information.

Organizations operating e-commerce environments should therefore monitor checkout pages as critical security assets.

Defensive controls should include:

  • continuous file-integrity monitoring;
  • JavaScript change detection;
  • Content Security Policy where feasible;
  • subresource integrity for externally loaded components;
  • monitoring of CDN and object-storage modifications;
  • database integrity monitoring;
  • Kubernetes configuration monitoring;
  • cron-job monitoring; and
  • alerting on unauthorized checkout-page changes.

Security teams should also maintain a baseline of every legitimate external domain a payment page is permitted to contact.

Unexpected outbound browser connections from checkout pages deserve immediate investigation.

Cloud storage and CDNs are part of the attack surface

The use of S3 and CDN poisoning is particularly important.

Modern websites often treat CDN content and cloud storage as trusted extensions of the application.

Attackers understand that modifying a JavaScript file at the CDN or object-storage layer may allow them to compromise large numbers of visitors without changing the primary web application itself.

Organizations should therefore protect cloud content with:

  • least-privilege IAM permissions;
  • short-lived credentials;
  • write-access restrictions;
  • object versioning;
  • integrity monitoring;
  • audit logs; and
  • strong alerts for unexpected modification of production web assets.

A checkout page is only as trustworthy as every script it ultimately loads.

AI is reducing the skill barrier for attackers

This campaign does not mean AI has suddenly invented new categories of exploitation.

The techniques involved, vulnerability scanning, command execution, web-shell deployment, JavaScript injection, persistence, and card skimming, have existed for years.

What AI changes is the speed and accessibility of coordinating them.

A less experienced attacker can increasingly delegate complex tasks to specialized agents.

The attacker does not necessarily need expert knowledge of every web framework, cloud platform, Kubernetes environment, or exploitation technique.

Instead, AI systems can help bridge those knowledge gaps.

This potentially expands the number of actors capable of conducting sophisticated multi-stage campaigns.

Defenders need automation as well

The obvious defensive implication is uncomfortable but unavoidable.

Human analysts cannot manually review every event at the speed automated attackers can generate them.

Defensive systems increasingly need to automate:

  • attack-surface discovery;
  • exposure prioritization;
  • behavioral detection;
  • containment;
  • credential revocation;
  • asset isolation;
  • integrity validation; and
  • recovery testing.

The objective should not be to remove humans from security decisions.

It is to ensure that a defender's first meaningful response does not occur several hours after an automated attacker has already completed reconnaissance, exploitation, data theft, persistence, and cleanup.

Recovery becomes as important as prevention

This campaign also reinforces the importance of cyber resilience.

Organizations should assume that prevention may occasionally fail.

They should know:

  • which systems must be restored first;
  • how quickly checkout services can be rebuilt;
  • whether clean backups exist;
  • whether infrastructure configurations can be recreated;
  • whether payment systems can operate independently of compromised components; and
  • how quickly stolen credentials can be invalidated.

The attacker in this campaign demonstrated that data loss may occur even when destruction is not the primary objective.

That makes tested recovery processes critical.

Backups that technically exist but have never been restored under realistic conditions are not a resilience strategy.

They are optimism stored on disk.

The broader cybersecurity lesson

This campaign may represent one of the clearest demonstrations yet of how agentic AI can change the economics and scale of financially motivated cybercrime.

The attackers did not invent payment-card skimming.

They did not invent vulnerability exploitation.

They did not invent persistence.

What changed was the ability to coordinate these techniques automatically against large numbers of organizations at extremely low marginal cost.

The result was:

105 attack campaigns in five days

at least 27 organizations compromised during that period

119 websites infected with skimmers overall

more than 600,000 valid payment cards stolen

and an average AI operating cost of approximately:

$25 per target.

That last number deserves particular attention.

When attackers can spend tens of dollars to perform hours of adaptive offensive work against one organization, cybersecurity can no longer depend on the assumption that an attacker's time is expensive.

Agentic AI is beginning to turn skilled offensive activity from a scarce resource into a scalable service.

For defenders, the answer is not panic about artificial intelligence.

It is reducing exposed attack surface, monitoring critical applications continuously, detecting unauthorized changes rapidly, automating containment where appropriate, and ensuring that compromised systems can be recovered faster than attackers can damage them.

The attackers are becoming faster.

Defensive processes built around weekly meetings and monthly remediation cycles will therefore increasingly become the vulnerability.

A financially motivated threat actor is using open-source AI agent frameworks to attack hundreds of online retailers at scale, stealing more than 600,000 credit card records. [...]

Source: Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers via Bleeping Computer — published 23 Sep 2026.