Cairn (Organization): news timeline & CVEs

Autonomous AI Agents Hack Online Retailers for $25 Per Target, Steal 600,000 Credit Cards

Operator using open-source AI agents Strix, Cairn, and Hermes compromised hundreds of retailers, stealing 600,000+ credit cards at about $25 per target.

Gambit Security uncovered an ongoing campaign, active since July 2026, in which a financially motivated operator used three open-source agents—Strix for reconnaissance, Cairn for autonomous exploitation, and Hermes for orchestration—to attack online retailers, stealing over 600,000 unexpired card records from two confirmed victims. Between September 10-15, 2026, the operator launched 105 attack projects and compromised at least 27 organizations, spending $7,005.71 via OpenRouter over four weeks with per-target costs of $3.13-$79.31. Web skimmers were injected via JavaScript bundles, Google Tag Manager blocks, database edits, and cloud content poisoning, followed by destructive cleanup including wiping payment fields and deleting 180 Magento tables. Operators issued brief Chinese-language prompts while agents autonomously performed scanning, exploitation, web-shell deployment, and data theft, with DNS exfiltration to staging infrastructure.

GBHackersupdated Sep 25, 17:38 UTC · 1d agofirst Sep 23, 07:26 UTC · 4d agoData breach in the wild 6 sources

AI malware just removed the human from the attack loop

Cisco Talos uncovers CLOSEDQUORUM, first 'LLM-as-C2' malware using multi-model judge panel to autonomously steal credentials and crypto wallets.

Cisco Talos's CAIRN research toolkit identified CLOSEDQUORUM, a 64-bit Go Windows binary described as the first 'LLM-as-C2' architecture that automates an entire attack phase without a human operator. A panel of LLMs (DeepSeek, Qwen, Mistral, Google Gemini) votes on next actions via constrained JSON decisions, with deterministic tie-breaking biased toward DeepSeek. It performs LSASS credential dumping, steals saved browser passwords from Chrome, Edge, and Firefox, and targets crypto wallets including MetaMask, Ethereum, and Exodus. Talos states there is no confirmation of CLOSEDQUORUM deployment in the wild, and simultaneously released CAIRN as an open-source toolkit for hunting AI-integrated malware via VirusTotal metadata.

CSO Onlineupdated Sep 24, 05:44 UTC · 3d agofirst Sep 23, 00:39 UTC · 4d agoMalware 13 sources

Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards

Gambit Security details an unsupervised AI-agent campaign using Strix, Cairn and Hermes that breached 27+ retailers and stole 600,000+ credit cards for about $25 per target.

A financially motivated operator ran three open-source AI agents (Strix for scanning, Cairn for exploitation, Hermes for orchestration) against online retailers from July 2026, compromising at least 27 companies and extracting over 600,000 credit card records, roughly 488,000 of them US cards. Mean cost per completed scan was $25.46 via OpenRouter, with heavy work routed to DeepSeek and Kimi after newer models refused. A documented chain used unauthenticated SQL injection, a web shell, sudo misconfiguration escalation, AWS Secrets Manager dumping, and Magento encryption-key theft to decrypt stored cards. The operator also planted skimmers on 19 named victims plus 100+ sites and wiped victim databases, and the campaign remains active.

Cyber Security Newsupdated Sep 25, 17:38 UTC · 1d agofirst Sep 22, 15:51 UTC · 4d agoThreat actor in the wild 6 sources

Cairn

Timeline3 articles

Appears with

Autonomous AI Agents Hack Online Retailers for $25 Per Target, Steal 600,000 Credit Cards

AI malware just removed the human from the attack loop

Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards