AI tools help hacker break in for $25 per target
AI-driven campaign compromised 27 of 105 retailers and stole about 600,000 card numbers.
Israeli security firm Gambit reports that an attacker used open-source AI harnesses to hit 105 online retailers over five days and compromise 27. From two businesses the attacker took about 600,000 active credit card details, and card-skimmer scripts were installed at five more, with additional access to unnamed major companies. Gambit identifies Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes for campaign orchestration, with model access via OpenRouter. An August 25 balance showed $7,005 spent over four weeks, about $25 per target, ranging from $3.13 to $79.31.
- An attacker hit 105 retailers in five days and compromised 27.
- Two businesses lost about 600,000 active credit card numbers.
- Card-skimmer scripts were installed on five additional stores.
- Strix, Cairn, and Hermes automated search, exploitation, and orchestration.
- OpenRouter spend was about $7,005, roughly $25 per target.
Full article254 words · extracted from csoonline.com · click to collapse
It’s cheap to set yourself up as a hacker these days using AI. Someone attacked 105 online retailers over a period of five days, compromising 27 of them — all for an average of $25 per attack, according to research by Israeli security company Gambit.
But the attacks have been going on for much longer. Whoever is responsible used open-source AI harnesses to mount the attack. Gambit has identified three of these: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign. The attacks have proved to be highly lucrative, with 600,000 active credit card details taken from just two businesses, the installation of card skimmer scripts at five more, and some level of access to an unspecified number of major companies.
It has been a highly efficient attack, most access taking just a few hours and at a minimal cost. OpenRouter was used for AI model access. The capture of the account balance on August 25 showed the attacker spent just $7,005 over a four-week period. This worked out at roughly $25 per attack, with costs ranging from $3.13 for the cheapest target to $79.31 for the most expensive.
Gambit has contacted all the companies concerned, but warned that the intensity of the attacks shows how AI is transforming cyber criminals’ activities by providing a level of sophistication that humans would find more challenging to muster. We are already seeing a new level of incursions to businesses and can expect to see more in the future.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.csoonline.com/article/4226861/ai-tools-help-hacker-break-in-for-25-per-target.html