Autonomous AI Agents Hack Online Retailers for $25 Per Target, Steal 600,000 Credit Cards
Operator using open-source AI agents Strix, Cairn, and Hermes compromised hundreds of retailers, stealing 600,000+ credit cards at about $25 per target.
Gambit Security uncovered an ongoing campaign, active since July 2026, in which a financially motivated operator used three open-source agents—Strix for reconnaissance, Cairn for autonomous exploitation, and Hermes for orchestration—to attack online retailers, stealing over 600,000 unexpired card records from two confirmed victims. Between September 10-15, 2026, the operator launched 105 attack projects and compromised at least 27 organizations, spending $7,005.71 via OpenRouter over four weeks with per-target costs of $3.13-$79.31. Web skimmers were injected via JavaScript bundles, Google Tag Manager blocks, database edits, and cloud content poisoning, followed by destructive cleanup including wiping payment fields and deleting 180 Magento tables. Operators issued brief Chinese-language prompts while agents autonomously performed scanning, exploitation, web-shell deployment, and data theft, with DNS exfiltration to staging infrastructure.
- 600,000+ unexpired card records stolen; 27+ organizations compromised September 10-15.
- Agents Strix, Cairn, Hermes automated recon, exploitation, skimming, and cleanup.
- Campaign cost roughly $12,000-$18,000, averaging $25.46 per completed target.
- Destructive automation wiped payment fields and deleted 180 Magento database tables.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1485 Data Destruction
- Organizations
- Gambit SecurityStrixCairnHermesOpenRouterMagento
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | b8t.shop | nd DNS exfiltration Domain traffic-analyzer[.]net C2 Domain b8t[.]shop Skimmer host Domain cdn[.]netlfjs[.]com Skimmer host Doma |
| domain | cdn.js-static.com | ]co Skimmer host Domain static-js[.]com Skimmer host Domain cdn[.]js-static[.]com Skimmer host Domain js-static[.]com Skimmer host Domain |
| domain | cdn.netlfjs.com | fic-analyzer[.]net C2 Domain b8t[.]shop Skimmer host Domain cdn[.]netlfjs[.]com Skimmer host Domain x1opay[.]co Skimmer host Domain sta |
| domain | jsnetlify.com | com Skimmer host Domain js-static[.]com Skimmer host Domain jsnetlify[.]com Skimmer host Domain netlifyjs[.]com Skimmer host Domain n |
| domain | js-static.com | immer host Domain cdn[.]js-static[.]com Skimmer host Domain js-static[.]com Skimmer host Domain jsnetlify[.]com Skimmer host Domain n |
| domain | medbooksource.com | IP 172.245.224.188 C2 IP 172.245.89.137 Skimmer host Domain medbooksource[.]com Operator console, OOB and DNS exfiltration Domain traffic |
| domain | netlifyjs.com | com Skimmer host Domain jsnetlify[.]com Skimmer host Domain netlifyjs[.]com Skimmer host Domain newssjs[.]com Skimmer host URL b8t[.] |
| domain | newssjs.com | com Skimmer host Domain netlifyjs[.]com Skimmer host Domain newssjs[.]com Skimmer host URL b8t[.]shop/js/sby.js Skimmer payload URL |
| domain | static-js.com | s[.]com Skimmer host Domain x1opay[.]co Skimmer host Domain static-js[.]com Skimmer host Domain cdn[.]js-static[.]com Skimmer host Do |
| domain | traffic-analyzer.net | rce[.]com Operator console, OOB and DNS exfiltration Domain traffic-analyzer[.]net C2 Domain b8t[.]shop Skimmer host Domain cdn[.]netlfjs[.] |
| domain | x1opay.co | Skimmer host Domain cdn[.]netlfjs[.]com Skimmer host Domain x1opay[.]co Skimmer host Domain static-js[.]com Skimmer host Domain c |
| ipv4 | 155.254.22.215 | authorized access to cloud secrets. IoC Type IOC Context IP 155.254.22.215 Staging and command server; AI console IP 209.126.4.170 DNS |
| ipv4 | 172.245.224.188 | tion, catch-all mail, HTTP listeners IP 213.21.239.62 C2 IP 172.245.224.188 C2 IP 172.245.89.137 Skimmer host Domain medbooksource[.]co |
| ipv4 | 172.245.89.137 | HTTP listeners IP 213.21.239.62 C2 IP 172.245.224.188 C2 IP 172.245.89.137 Skimmer host Domain medbooksource[.]com Operator console, O |
| ipv4 | 209.126.4.170 | IP 155.254.22.215 Staging and command server; AI console IP 209.126.4.170 DNS exfiltration, catch-all mail, HTTP listeners IP 213.21. |
| ipv4 | 213.21.239.62 | 6.4.170 DNS exfiltration, catch-all mail, HTTP listeners IP 213.21.239.62 C2 IP 172.245.224.188 C2 IP 172.245.89.137 Skimmer host Dom |
From the original article
3 min read at gbhackers.com
A financially motivated threat actor used open-source autonomous AI agents to target hundreds of online retailers, stealing over 600,000 unexpired credit card records. The average cost per completed target is estimated at $25. 46.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.