AI-Powered Campaign Targets Hundreds of Online Retailers
A Chinese-speaking actor used autonomous AI agents to compromise online retailers and steal over 600,000 credit cards.
Gambit says a Chinese-speaking, financially motivated actor has targeted hundreds of online retailers since July 2026 using three open-source AI agent harnesses. Between 10 and 15 September the actor launched 105 attack projects and compromised at least 27 companies, stealing more than 600,000 unexpired credit cards from two victims, including over 488,000 US cards, and injecting checkout skimmers. Strix on GLM 5.2 and DeepSeek v4 Pro hunted flaws, Cairn on DeepSeek v4.1 Flash drove exploitation, and Hermes on Anthropic opus-4.6 handled orchestration from short Chinese prompts. With researcher Varys, Gambit linked the skimmer to more than 100 additional sites and estimated a mean cost of $25.46 over 101 completed scans.
- Active since July 2026; 105 projects and 27 compromises in five September days.
- More than 600,000 unexpired cards stolen, including over 488,000 from the US.
- Strix, Cairn, and Hermes automated hunting, exploitation, and intrusion orchestration.
- Skimmers planted in JavaScript, tags, S3, databases, Kubernetes, and a JBoss cron.
- Gambit estimates a mean cost of $25.46 across 101 completed scans.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1059.007 JavaScriptT1053.003 Scheduled Task/Job: CronT1070.004 File Deletion
- Vendors
- AnthropicDeepSeekOpenRouter
- Organizations
- GambitAnthropicOpenRouterTalion Cyber Security
- Countries
- ChinaUnited States
From the original article
4 min read at securityweek.com
A threat actor is using three AI harnesses for vulnerability research, exploitation, and attack orchestration. The post AI-Powered Campaign Targets Hundreds of Online Retailers appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.