A new report from cybersecurity startup **Gambit** reveals a sophisticated, large-scale skimming campaign powered by open-source AI agent frameworks. This operation, active since at least July, has resulted in the theft of over 600,000 valid credit card details and the compromise of more than 100 online retailers. The threat actor, believed to be Chinese, utilizes a trio of AI tools to execute the attack chain with remarkable efficiency, targeting dozens of companies daily. In just five days, the campaign successfully breached at least 27 companies and launched over 100 distinct attacks. ### The AI Arsenal Behind the Attacks The campaign's success hinges on three key AI tools: * **Strix**: A penetration testing framework for extensive scanning and vulnerability discovery. * **Cairn**: An autonomous exploitation engine tasked with achieving objectives like obtaining shell access or administrative privileges. (Note: This is distinct from the AI malware analysis tool recently released by **Cisco Talos**). * **Hermes**: The central orchestration tool, managing campaign flow, post-exploitation activities, tactical decisions, and directing malicious actions. **Gambit** researchers observed **Strix** running 146 times against 138 hosts between August 23 and 31, accumulating 633 hours of scanning activity. **Hermes** notably contained a persona named "SOUL - Red Team Operator" with 121 skills, 78 of which were attack-related. The human operator provided the AI agents with brief instructions on the operation's goals, allowing the AI to autonomously manage the rest of the attack lifecycle. Between September 10 and 15 alone, the attacker launched 105 distinct attack waves, achieving varying degrees of success on at least 27 targets.  **Cairn activity** *Source: Gambit* ### Diverse Skimming and Post-Exploitation Tactics The attackers employed various methods to inject skimmers into target websites, adapting to the level of access, identified vulnerabilities, and system architecture. These tactics included: * Appending malicious code to legitimate JavaScript files. * Adding script tags to checkout pages or **Google** tag blocks. * Poisoning **S3/CDN** content and server-side caches. * Modifying database fields. * Altering **Kubernetes** deployments. * Utilizing cron jobs to re-establish skimmers after removal.  **Injected card skimmer** *Source: Gambit* **Gambit** researchers gained access to the attacker's staging server, uncovering direct evidence of the campaign. The operation successfully compromised at least 119 websites with credit card skimmers, affecting major organizations including a Fortune 500 hospitality company, a large U.S. airline, a significant U.S. industrial supplies distributor, and an online fashion retailer. The attackers prioritized targets running custom software, likely due to a higher probability of vulnerabilities, using a website traffic-ranking service to identify valuable victims from **Strix**'s output.  **Stolen credit cards** *Source: Gambit* Intriguingly, the investigation also revealed that the attacker instructed the **Hermes** agent to perform cleanup procedures, wiping card data from **Magento** databases after exfiltration. This instruction, found in one of the **Hermes** agent's skill files, stated: "After extracting and downloading all card data, wipe the source fields in batches." This tactic led to operational disruptions and data losses for several affected retailers. ### Low Costs, High Impact **Gambit** researchers gained insight into the operational costs, finding an **OpenRouter** account showing $7,005.71 spent over approximately four weeks as of August 25. Based on subsequent usage, the total estimated cost for the campaign ranges between $12,000 and $18,000, averaging out to a mere $25 per target. "Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company," **Gambit** explained in their blog post. The attacker's own cost review corroborated this, showing a mean of $25.46 over 101 completed scans, with costs ranging from $3.13 to $79.31 per target. This low operational cost, combined with the high degree of automation, makes such attacks accessible even to less-skilled threat actors. In many instances, access was achieved within hours, with AI tools performing the bulk of the work based on minimal instructions from the human operator. **Gambit** warns that organizations must not only defend against these AI-powered attacks but also plan for potential data loss resulting from the attacker's post-exfiltration cleanup routines.