Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards

A financially motivated operator has been running three open-source AI tools against many online retailers, mostly without supervision.

The results are shocking: over 600,000 credit card records have been stolen, scripts to gather card information have been placed on dozens of checkout pages, and in at least two cases, the operator’s cleanup routine completely wiped out the victims’ data.

Gambit Security’s Threat Intelligence team recovered the operator’s exposed staging server and reconstructed the campaign from what it left behind, and the picture it reveals is sobering for every security team.

The economics are what make this campaign so alarming. Between August and September 2026, the operator spent somewhere between $12,000 and $18,000 on AI model access through OpenRouter, a figure corroborated by an account balance snapshot of $7,005.71 captured on August 25 for a four-week window.

Spread across the companies attacked, that works out to a marginal cost of just a few dollars to a few tens of dollars per target.

The operator’s own cost review put the mean at $25.46 across 101 completed scans, ranging from $3.13 for the cheapest victim to $79.31 for the most expensive. At that price, the traditional economics that once filtered out low-skill attackers no longer apply.

AI Agents Credit Card Theft

According to research published by Gambit Security, the activity, which dates back to July 2026 and is still running, leaned on three off-the-shelf AI tools working in concert.

Strix handled autonomous vulnerability discovery, Cairn ran end-to-end exploitation for hours at a time until it achieved a shell or admin access, and Hermes orchestrated the whole campaign, launching intrusion jobs, steering activity, and giving tactical guidance during the impact stage.

Between August 23 and 31 alone, Strix ran 146 deep-mode scans against 138 hosts, burning 633 hours of scanner time inside just 195 hours of clock time, a tempo no human team could sustain.

The human role became limited to brief instructions. In 260 Hermes sessions, the operator typed only 1,951 commands. These were mostly short phrases in Chinese, like “read the vulnerability report and start” or “can it get code execution?”

Hermes itself was loaded with 121 skills, 78 of them offensive, plus a custom skill designed to strip out its own content-safety filters. Model choice mattered: the operator settled on Anthropic’s Opus 4.6 only after newer models refused the requests, and routed the heaviest work through Chinese models DeepSeek and Kimi.

The pattern mirrors other 2026 campaigns in which actors gravitated to permissive open frameworks paired with the least-restricted models available.

Between September 10 and 15, Cairn launched 105 attack projects, and at least 27 companies were compromised to varying degrees. Because each path was chosen in real time through relentless probing, the tactics differed from victim to victim.

One fully documented chain began with an unauthenticated SQL injection, read a plaintext OTP to bypass MFA, uploaded a web shell for host code execution, escalated to root through a misconfigured sudo rule, pivoted across an NFS mount, dumped 46 secrets from AWS Secrets Manager, reached the main Magento database, and finally extracted the encryption key to decrypt stored card numbers. Victims spanned a Fortune 500 hospitality firm, a major US airline, a large industrial supplies distributor, and an online fashion retailer.

The 600,000-plus card records came from two victims and were validated by anti-fraud firm Overwatch Data, which found the vast majority roughly 488,000 cards, or 79 percent belonged to US holders.

A payment processor later confirmed that at least 60 percent of a sampled batch had not previously been flagged for fraud, underscoring the data’s freshness.

The most unsettling finding is that the worst damage did not come from extortion. One Hermes skill file, titled “Database Wipe After Extraction,” instructed the agent to erase card fields from the victim’s Magento database once the data was exfiltrated, expecting tables with millions of rows.

At a second victim, a bicycle retailer, the agent created staging tables and then dropped 180 tables matching its own naming pattern, including backup tables the company’s own administrators had made.

Skimmers were the other core objective, confirmed on 19 named victims and traced to more than 100 additional infected sites with help from researcher Varys.

Injection methods varied by access level, from appending a loader to a legitimate jQuery file, to poisoning an S3 bucket behind a CDN, to a Kubernetes initContainer, to a cron job in a JBoss log directory that re-injected the skimmer every two minutes whenever a redeploy cleaned it.

This campaign matters far more than its raw numbers suggest. The tooling is open source, the marginal cost sits in the tens of dollars, and access, when achieved, usually took less than a day, while remediation in complex environments is still measured in weeks.

Currently, reported critical vulnerabilities across major vendors exceed 600 each month, and about 87 percent of the flaws attackers exploit occur on or before public disclosure. Detection thresholds, change windows, and on-call rotations calibrated to human pace simply cannot keep up with that clock.

A recovery plan that ends at “the database is restored” no longer answers that question. Gambit says it has notified many affected organizations and worked with the Shadowserver Foundation and Cloudflare to dismantle the infrastructure, though the operator has repeatedly rebuilt it and the campaign continues.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC