A threat actor is using AI agents to attack online retailers at scale, according to cybersecurity company Gambit. Researchers say the campaign has stolen more than 600,000 valid payment card records and placed skimmers on at least 119 websites.
Attacker Uses Three AI Tools
Gambit traced the campaign to at least July 2026. Between September 10 and 15, the attacker launched 105 distinct attack waves and compromised at least 27 companies to varying degrees.
The operation uses three open-source tools. Strix scans targets for vulnerabilities, while Cairn attempts to gain access. Hermes then coordinates decisions and activity after a breach.
According to the researchers, the human operator gave the tools brief instructions and let them carry out much of the work. However, the findings describe one attacker’s campaign, not every use of these tools.
Skimmers Target Retail Checkout Pages
Gambit says the attacker stole more than 600,000 valid card records from two companies. The researchers also found payment skimmers across at least 119 compromised websites.
The attacker placed malicious code in different locations depending on each site’s setup. For example, the code appeared in legitimate JavaScript files, checkout pages, content delivery systems and server-side caches.
In some cases, the attacker used scheduled tasks to restore a skimmer after someone removed it. Gambit says it found direct evidence of the activity on an attacker-operated staging server.
The AI agents also followed instructions to erase card data from some Magento databases after stealing it. As a result, several retailers suffered data loss and operational disruption.
Low Costs Help Scale the Campaign
Gambit found records showing about $7,000 in AI service spending over roughly four weeks. Based on later usage, it estimated the campaign’s total cost at $12,000 to $18,000.
The attacker’s own figures put the average cost at about $25 per completed scan. Consequently, Gambit warns that attackers can run broad campaigns with limited spending and brief human instructions.
The researchers advise retailers to prepare for both payment theft and possible data loss when investigating a compromise.
0 responses to “AI Agents Steal 600,000 Card Records in Retail Attacks”