Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs
An operator used three open-source AI agents to compromise at least 27 organizations and steal over 600,000 card records.
Security firm Gambit reconstructed a campaign in which a Chinese-speaking operator used the open-source AI harnesses Hermes, Strix, and Cairn to attack retailers and other companies. Between September 10 and 15 the operator launched at least 105 attacks and compromised at least 27 organizations, including a Fortune 500 hospitality company and a major US airline. Two victims lost more than 600,000 credit card records, and skimmer scripts were confirmed on 19 websites, with over 100 additional infected sites reported. One intrusion used SQL injection, a web shell, a misconfigured sudo rule, and theft of AWS credentials and 46 secrets; Gambit estimates total model costs at $12,000 to $18,000.
- Gambit says at least 27 companies were compromised from September 10 to 15.
- More than 600,000 card records were stolen from two victims.
- Hermes, Strix, and Cairn automated scanning, exploitation, and skimmer deployment.
- OpenRouter model spend was estimated at $12,000 to $18,000.
- One intrusion used SQL injection, a web shell, sudo abuse, and stolen secrets.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1548.003 Sudo and Sudo CachingT1552.001 Credentials In Files
- Vendors
- Anthropic
- Organizations
- GambitOpenRouterAnthropic
- Countries
- United States
From the original article
4 min read at theregister.comA crook has been using three open source AI harnesses to target hundreds of online retailers and other companies, swiping more than 600,000 credit card records and installing card-stealing skimmers - and all at trivial cost.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.