Three AI agents, $25 a target, 600,000 stolen cards

Three open-source AI agent frameworks have been running a retail attack campaign almost unattended since July: 105 attack projects in five days, at least 27 companies compromised, and more than 600,000 card records taken from two of them. The mean cost per completed scan was $25.46. Gambit Security rebuilt the whole operation from the attacker's own staging server (Gambit Security).

What did the three harnesses actually do?#

The division of labor reads like a small company org chart. Strix, an open-source penetration testing tool, ran 146 deep-mode scans against 138 hosts between August 23 and 31, burning 633 hours of scanner time in 195 clock hours. Cairn, an autonomous exploitation engine, received domains and an objective, then ran for hours until it held a shell or an admin login. Hermes sat above both: a general agent with persistent memory and skills it writes itself, 121 of them, 78 attack-related.

The models were interchangeable parts. Strix ran on GLM 5.2 and later DeepSeek v4 Pro through OpenRouter, Cairn on DeepSeek v4.1 Flash, Hermes on Anthropic's opus-4.6, which the report notes was chosen after newer models refused the requests. The human stayed a dispatcher: 1,951 prompts across 260 sessions, mostly short Chinese instructions. One that recurs in the log: 跑这些 用代理 只扫高危, "run these, use the proxy, high severity only".

The bill matters as much as the org chart. A captured account balance shows $7,005.71 spent on OpenRouter over four weeks, and Gambit puts the full campaign cost between $12,000 and $18,000. The operator's own numbers agree: a mean of $25.46 per completed scan, from $3.13 to $79.31 (SecurityWeek).

Why custom shops made the list#

The target list came from a website traffic ranking service, shopping category, with a filter applied first: shops running the major hosted or open-source commerce platforms were removed, because the attacker assumed custom code was more likely to be vulnerable. Where access worked, it usually took less than a day, often a few hours.

One documented Cairn chain, condensed: an unauthenticated SQL injection, then the OTP table read in plaintext to bypass MFA, then an admin panel, an arbitrary file upload, host RCE, root, a lateral hop through an NFS mount, a WordPress plugin upload, a full dump of 46 secrets from AWS Secrets Manager, and finally the Magento database, whose Blowfish-ECB encrypted card column the agent decrypted with the store's own key.

The exit was part of the design. A Hermes skill titled Database Wipe After Extraction instructs the agent to erase the stolen card fields from the victim's database once the data is safe: "After extracting and downloading all card data, wipe the source fields in batches". At one bicycle retailer the agent's staging tables matched too broadly during cleanup, and 180 tables disappeared, including backup tables the shop's own administrators had made.

Where the skimmers hid#

Card skimmers were confirmed in place on 19 of the 27 named victims, and with the security researcher Varys another 100-plus infected sites turned up. The injection methods varied with the access the attacker had, and a few are worth memorizing:

• One line in a bundled library: the loader was appended to a jQuery or Bootstrap file the site already serves, and the original file timestamp was restored.
• Inside the analytics block: on one site the payload sat between the real gtag calls, padded with about a hundred tab characters so it ends up off the right edge of a source view.
• A cron job that repairs itself: at a US wine retailer, a redeploy restored the clean checkout bundle, so the attacker left a scheduled task that checked the file every two minutes and re-injected it.

The exfiltrated cards, more than 600,000 unexpired records, came from two companies, 79 percent of them issued in the United States. Card issuers were notified through Overwatch Data, a fraud intelligence firm (heise).

What changes for a shop you run#

• Keep card data off your server. Every victim here stored cards in its own database, and that column was the prize. A hosted checkout moves card data out of your blast radius entirely. I described the trade-offs for Telegram shops in the shop anatomy piece.
• Watch the checkout page like a deploy. The most common injection was one appended line in a bundled file. File-integrity checks on checkout assets and alerting on unexpected script hosts would have caught most of the documented methods within minutes.
• Treat cleanup as a threat. The wipe step and the 180 dropped tables were side effects of the attacker's tidying, not a ransom note. Backups that live outside the compromised database, tested against real restores, are the only answer to that class of loss.
• Re-time the defenses. Access arrived in hours while patch cycles run in weeks, so detection has to close the gap. If every request needs a signature, verify it on your side. The initData validation post covers that pattern for Mini Apps.

What this changes for my own shops#

I build shop bots for German small businesses, and the decision to keep payments on hosted checkout pages started as a compliance shortcut. This campaign re-prices that decision. The attacker filtered out the hosted platforms on purpose and went shopping for custom code, which is exactly the segment my clients sit in, now reachable at $25 a scan. Gambit calls the report interim and estimates the real scale is larger. The economics changed; the defense budget of a small shop did not.