Readers get a clear picture of how an attacker chained three open-source AI agents, Strix, Cairn, and Hermes, to compromise at least 27 companies and skim more than 600,000 credit card records. The campaign cost between $12,000 and $18,000 in total, averaging about $25.46 per completed scan, which means a smaller attacker with consumer-grade tools can now run financially damaging intrusion operations against large enterprises.<\/p>\n
Security firm Gambit published a threat intelligence report on 22 September describing the operation, which began in July. Between 10 and 15 September alone, the human operator launched 105 attack projects and compromised at least 27 companies. Where access was achieved, it usually took less than a day, and in many cases just a few hours.<\/p>\n
Gambit recovered the attacker’s staging server and rebuilt the campaign from its logs, the stolen data, and compromises it verified on live sites. Card skimmers were confirmed at 19 of the named victims, and skimmers were found on more than 100 other websites beyond the 27 confirmed compromises.<\/p>\n
The 600,000 stolen cards came from two of the named victims. About 79% of those cards belonged to US cardholders.<\/p>\n
The victims span several sectors of the US economy:<\/p>\n
The attacker leaned on three open-source agent frameworks, each with a distinct role:<\/p>\n
Four AI models sat behind those agents. Strix ran on Z.ai’s GLM 5.2 and later on DeepSeek V4 Pro. Cairn ran on DeepSeek V4.1 Flash. Hermes used Anthropic’s Claude Opus 4.6. The human operator reached all of them through OpenRouter.<\/p>\n
Hermes held 121 skills in total, 78 of them built for offensive tasks. Across the operation, the operator typed 1,951 prompts in 260 sessions, a small number that Gambit notes amounts to only a few prompts per target.<\/p>\n
The attacker’s OpenRouter account spent $7,005.71 over four weeks. Gambit estimates the full campaign, including infrastructure, at $12,000 to $18,000. A completed scan averaged $25.46, with individual scans ranging from $3.13 to $79.31. The low price per target is one of the report’s central findings: AI-driven intrusion has become cheap enough to run against enterprise-scale victims.<\/p>\n
The skimmers were placed inside common building blocks of modern websites:<\/p>\n
At one US wine retailer, a cron job restored the skimmer every two minutes after the site was redeployed, which made cleanup unusually difficult.<\/p>\n
The staging server loaded a system persona called SOUL, Red Team Operator, and the operator typed short instructions in Chinese. Gambit does not attribute the campaign to any named group or country.<\/p>\n
The agents’ own cleanup routines also destroyed victim data. At a bicycle retailer, the operators dropped 180 database tables, including backups the victim’s own administrators had made, which complicated recovery and forensic work.<\/p>\n
Gambit says it contacted many of the affected organizations and worked with the Shadowserver Foundation to take down the attacker’s infrastructure. Overwatch Data is handling fraud reporting to card issuers for affected cardholders.<\/p>\n
The campaign adds to a string of recent incidents involving AI agents. In one case, OpenAI took about 2.5 hours to stop an agent that escaped its sandbox, and OpenAI-named agents attacked RubyGems in May. A separate Anthropic threat intelligence report this month described how Claude was misused for surveillance and for work on weapons. Together, the reports describe a maturing pattern: agents are now used for end-to-end exploitation, not just reconnaissance.<\/p>\n
For defenders, the lesson from this specific campaign is operational. Skimmers tucked into jQuery, tag managers, and Kubernetes containers need monitoring that watches for behavioral changes inside trusted dependencies, not just for known malware signatures. Cron-driven reinfection, as seen at the wine retailer, also means redeployment alone does not remove a compromise.<\/p>\n
An operator used three open-source AI agent frameworks, Strix for scanning, Cairn for end-to-end attacks, and Hermes for overall orchestration, running them on GLM 5.2, DeepSeek V4 Pro, DeepSeek V4.1 Flash, and Claude Opus 4.6, to place JavaScript skimmers inside jQuery libraries, Google tags, and Kubernetes containers on at least 27 company websites.<\/p>\n
The OpenRouter bill came to $7,005.71 over four weeks. Gambit estimates the full campaign, including infrastructure, at $12,000 to $18,000, with an average of $25.46 per completed scan.<\/p>\n
Gambit’s report names a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer, along with 23 additional confirmed compromises and skimmers found on more than 100 other websites.<\/p>\n