AI Agents Orchestrate Low-Cost, High-Impact Attacks, Stealing Millions in Card Data
A threat actor leveraged three open-source AI agents to conduct automated attacks, compromising over 27 organizations and stealing more than 600,000 credit card records.
A sophisticated cybercriminal has orchestrated a series of highly effective, low-cost attacks against numerous organizations, including a major US airline and a Fortune 500 hospitality company, by employing three open-source AI agents. The campaign, which cost the operator an estimated $12,000 to $18,000, resulted in the theft of over 600,000 credit card records and the deployment of card-skimming malware across at least 27 compromised entities.
The campaign, meticulously reconstructed by security firm Gambit, utilized AI agents named Hermes, Strix, and Cairn to autonomously identify vulnerabilities, execute complex attack workflows, and achieve objectives such as deploying web shells and escalating privileges. The human operator, who communicated in Chinese, managed these agents through a staging server, directing them to target online retailers and other businesses with remarkable speed and efficiency. Between September 10 and September 15 alone, at least 105 attacks were launched, with successful compromises often occurring within hours of initial access.
Hermes served as the central orchestrator, an always-on AI assistant capable of independent multi-step task execution and workflow management. The operator loaded Hermes with a persona titled "SOUL - Red Team Operator" and equipped it with 121 skills, 78 of which were dedicated to offensive operations. Notably, one skill was designed to bypass the AI harness's content security filters. Hermes utilized Anthropic's Claude Opus 4.6 model, with the operator issuing 1,951 prompts in Chinese across 260 sessions, often instructing the AI to probe for code execution and assess vulnerability reports.
Strix, an open-source penetration testing tool, was employed by the attacker to systematically scan for exploitable vulnerabilities within targeted organizations. This tool was run through OpenRouter on GLM 5.2 and DeepSeek v4 Pro models. Between August 23 and August 31, Strix was executed 146 times in "deep mode" against 138 hosts, accumulating over 633 hours of scanning time within a 195-hour clock period. The objective was to identify weaknesses that could be leveraged for further exploitation.
Once vulnerabilities were identified by Strix, the attack progression was handed off to Cairn, another autonomous AI penetration testing tool running on DeepSeek v4.1 Flash. Cairn was tasked with specific objectives, such as deploying a web shell or achieving administrative access, and would continue its operations until the objective was met, a timeout occurred, or human intervention was required. Cairn's attack paths were dynamically chosen in real-time through extensive probing and exploitation attempts, leading to varied tactics, techniques, and procedures (TTPs) across different victims.
In several instances, the AI agents successfully exfiltrated significant amounts of sensitive data. In one documented case, an AI agent used SQL injection to gain access to a web panel, uploaded a web shell, escalated privileges via a misconfigured sudo rule, and ultimately accessed AWS credentials, leading to the dumping of 46 secrets totaling 102KB. In two separate attacks, the AI agents successfully exfiltrated over 600,000 credit card records from just two victim companies.
Beyond data theft, a primary goal of the campaign was the deployment of card-skimming scripts onto the checkout pages of online shops. The operator directed Cairn to deploy these scripts against at least 27 named victims, with confirmed presence on 19 websites. Security researcher Varys also identified over 100 additional infected websites linked to this operation. The most common method for injecting these skimmers involved appending malicious code to existing JavaScript files.
Gambit highlighted that this campaign dramatically shortens the "remediation clock" – the time organizations have to detect and fix vulnerabilities. The AI agents operated at a tempo unattainable by human operators, reducing the human's role to providing brief instructions between autonomous runs. This rapid exploitation cycle underscores the urgent need for organizations to not only accelerate patching but also to enhance their overall incident detection and response capabilities in the face of increasingly autonomous and efficient threat actors.