A financially motivated operator has used a collection of open-source artificial-intelligence tools to automate attacks against online retailers at a reported average cost of only $25.46 per completed scan. According to research summarized by Cyber Security News, the campaign compromised organizations, placed payment-card skimmers on checkout systems and obtained more than 600,000 card records from two victims.

Gambit Security reconstructed the activity after gaining access to an exposed staging server used by the operator. The recovered material suggests the campaign began in July 2026 and was still active when reported. Its significance is not merely the number of victims: it shows how inexpensive agentic tooling can compress reconnaissance, exploitation and post-compromise work into a largely automated workflow.

Three tools divided the attack workflow

The operator reportedly combined three off-the-shelf systems. Strix performed autonomous vulnerability discovery, Cairn pursued exploitation until it obtained a shell or administrative access, and Hermes coordinated jobs and provided tactical direction during later stages. Hermes contained 121 skills, including 78 offensive capabilities and a custom module intended to remove built-in safety restrictions.

Human input was comparatively sparse. Across 260 Hermes sessions, the operator entered 1,951 commands, many of them short directions such as asking the system to read a vulnerability report and begin. Between August 23 and August 31, Strix performed 146 deep scans against 138 hosts and accumulated 633 scanner-hours inside 195 hours of elapsed time, demonstrating the parallelism that automation can provide.

The campaign reportedly spent between $12,000 and $18,000 on model access during August and September. An operator-authored cost review covering 101 scans recorded prices ranging from $3.13 to $79.31, with an average of $25.46. That low marginal cost changes the economics of opportunistic intrusion by making smaller retailers worthwhile targets and allowing repeated attempts without a large human workforce.

One intrusion chained weaknesses across the stack

Researchers documented a campaign path that began with unauthenticated SQL injection. The agent retrieved a plaintext one-time password, bypassed multifactor authentication, uploaded a web shell and escalated to root through an unsafe sudo configuration. It then moved through an NFS mount, collected 46 secrets from AWS Secrets Manager, reached a Magento database and obtained the key required to decrypt stored card numbers.

The sequence is important because it was not a single magic exploit. It combined application flaws, weak secret handling, excessive privileges and reachable infrastructure. The AI tooling selected and pursued a route dynamically, which means traditional detection based on one fixed chain may miss similar activity that reaches the same objective by different steps.

Card theft was paired with skimming and destruction

Anti-fraud firm Overwatch Data reportedly validated the corpus of more than 600,000 cards. About 488,000, or 79 percent, were associated with US cardholders. A payment processor later found that at least 60 percent of a sample had not already been flagged for fraud, suggesting much of the material was fresh.

Researchers also confirmed skimmers on 19 named victims and connected the infrastructure to more than 100 additional infected sites. Persistence varied with access: attackers modified a legitimate JavaScript file, poisoned an object-storage bucket behind a content-delivery network, used a Kubernetes init container, and created a cron job that restored malicious code every two minutes after redeployment.

Automation also caused destructive damage. A Hermes instruction directed the agent to wipe payment-card fields after extraction. At another victim, the agent dropped 180 tables matching its staging-table pattern, including backup tables created by administrators. These outcomes show that autonomous offensive systems can amplify operator intent and implementation mistakes alike.

Retail defenders need controls that operate at machine speed

Organizations should focus on removing the conditions that made the chained attacks possible:

• Prioritize internet-facing injection flaws and continuously test checkout applications.
• Remove plaintext OTPs and long-lived secrets from files, databases and automation workflows.
• Restrict sudo, NFS, cloud-secret and deployment permissions to the minimum required.
• Monitor unexpected changes to JavaScript, buckets, init containers, cron jobs and database schemas.
• Keep immutable, isolated backups and test restoration beyond the database layer.

Gambit said it notified affected companies and worked with Shadowserver and Cloudflare to disrupt the infrastructure, although the operator repeatedly rebuilt it. The defensive lesson is that response schedules designed around human-speed attacks are no longer sufficient. Rapid isolation, automated integrity monitoring and enforceable privilege boundaries are becoming essential for limiting AI-assisted intrusion campaigns.