AI-agent campaign breached websites at more than 100 companies
Original title: Hacker Uses AI Agents to Breach Over 100 Company Websites With Minimal Human Effort
NorForge tracked campaign AIA0001 across 14 dashboards; Deere, SharkNinja and Cummins were named.
NorForge and Reuters report that a Chinese-speaking operator used autonomous AI agents, organized through the open-source Cairn platform, to attempt intrusions against more than 100 company websites. The most active campaign, AIA0001, targeted e-commerce sites in the United States, Canada, Japan and Australia and sought persistent access to shopping and payment systems. One confirmed case placed an uploader shell after write access to a memcached session store and unsafe PHP deserialization involving legacy Zend Framework components. Deere said it remediated the issue and found no sensitive-data access; SharkNinja and Cummins described limited or still-investigated exposure.
Unconfirmed: The exploitation narrative came from the agent’s account, model attribution is cautious, token costs are estimates, and Reuters could not determine how much data was taken.
- More than 1,200 break-in attempts and over 1,100 AIA0001 projects were tracked.
- Successful AIA0001 projects averaged just under 23 hours, with nearly a 10% estimated success rate.
- Reuters put token spend near $5,000, about $50 per successful intrusion.
- TruffleHog verified 11% of hundreds of exposed credentials as valid.
- A worker identifier only hinted at Claude Code orchestration with a DeepSeek model.
Impact: Persistent web access and exposure of victim credentials
| Product | Affected |
|---|---|
| Zend Framework | — |
- 1.Hunt for attacker-installed uploader shells on exposed shopping and support sites.
- 2.Rotate credentials published in unsecured attacker dashboards.
- 3.Review legacy PHP apps for unsafe object deserialization and writable memcached session stores.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1046 Network Service DiscoveryT1595 Active Scanning
- Victims
- DeereSharkNinjaCummins
- Organizations
- NorForge
- Countries
- United StatesCanadaJapanAustralia
- AI models
- DeepSeek
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 199.247.25.25 | rastructure can worsen an initial compromise. IoC IOC Notes 199.247.25.25 AIA0002 staging server 199.247.27.2 AIA0002 staging server |
| ipv4 | 199.247.27.2 | promise. IoC IOC Notes 199.247.25.25 AIA0002 staging server 199.247.27.2 AIA0002 staging server 46.8.xxx.xx9:8000 AIA0001 panel 95.1 |
From the original article
3 min read at gbhackers.com
A Chinese-speaking hacker used autonomous AI agents to compromise the websites of more than 100 companies, relying primarily on software for most of the intrusion work. Reuters reporting and research published by NorForge on October 19 provide this information. According to the campaign, the operator made more than 1,200 break-in attempts, showing how a single […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.