AI-Powered Campaign Targets Hundreds of Online Retailers
A Chinese-speaking actor used autonomous AI agents to compromise online retailers and steal over 600,000 credit cards.
Gambit says a Chinese-speaking, financially motivated actor has targeted hundreds of online retailers since July 2026 using three open-source AI agent harnesses. Between 10 and 15 September the actor launched 105 attack projects and compromised at least 27 companies, stealing more than 600,000 unexpired credit cards from two victims, including over 488,000 US cards, and injecting checkout skimmers. Strix on GLM 5.2 and DeepSeek v4 Pro hunted flaws, Cairn on DeepSeek v4.1 Flash drove exploitation, and Hermes on Anthropic opus-4.6 handled orchestration from short Chinese prompts. With researcher Varys, Gambit linked the skimmer to more than 100 additional sites and estimated a mean cost of $25.46 over 101 completed scans.