Autonomous AI Agents Steal 600,000 Payment Cards From Online Retailers

A financially motivated operator reportedly used open-source autonomous AI tools—Strix for vulnerability discovery, Cairn for exploitation, and Hermes for orchestration—to compromise online retailers and deploy payment-card skimmers. Gambit Security said the campaign compromised at least 27 companies during a September attack period, stole more than 600,000 payment-card records from two victims, and deployed skimmers at 19 identified victims plus more than 100 additional infected sites.

The reported intrusion chains included SQL injection, MFA bypass using exposed one-time passwords, web-shell deployment, sudo privilege escalation, NFS pivoting, AWS Secrets Manager access, and Magento database theft. The operator's records reportedly showed an average cost of $25.46 for each of 101 completed scans, despite spending an estimated $12,000–$18,000 on AI-model access; in two cases, it deleted payment-card data and database tables after exfiltration. Gambit Security notified affected organizations and worked with Shadowserver Foundation and Cloudflare to disrupt the infrastructure, but said the operator continued rebuilding it.