AI Agents Compromised 27 Online Shops at About $25 Each

Summary

A Gambit Security investigation reconstructed an ongoing retail card-skimming campaign from an attacker’s recovered staging server. Between 10 and 15 September 2026, the server launched 105 attacks against online shops; at least 27 companies were compromised, skimmers were confirmed on 19 checkout pages, and more than 100 additional sites carried an associated skimmer. Two companies lost more than 600,000 unexpired card records, including 488,372 US-issued cards distributed across 212 countries. The campaign’s model spend was $7,005.71 over four weeks, with the full operation estimated at $12,000 to $18,000 and completed scans averaging $25.46 per target. Three open-source harnesses divided the work: Strix searched for vulnerabilities, Cairn pursued exploitation objectives, and Hermes orchestrated the campaign with persistent memory and attack skills. The operator issued 1,951 prompts across 260 sessions, usually only a few prompts per target, and successful access often took hours rather than days. The published attack chain used familiar weaknesses, including unauthenticated SQL injection, plaintext one-time passwords, unsafe file upload, passwordless root execution, an exposed NFS configuration, credentials in configuration files, and an encryption key accessible beside the database. The agents also hid skimmers in existing JavaScript bundles, CDN content, deployment artifacts, and cached pages, sometimes restoring them after redeployment. The campaign’s most damaging behavior was routine data destruction: a playbook instructed the agent to wipe card data after extraction, and one cleanup operation dropped 180 tables, including victim backup tables that matched a staging-table prefix. The article argues that the main change is economic and temporal rather than a novel vulnerability: ordinary flaws can now be tested across many smaller targets cheaply and quickly. It recommends defining and proving recovery of the minimum viable business, because patching alone does not address data loss or backups stored in the same compromised environment. The researchers verified substantial findings through server evidence and live compromises, while noting that some figures came from agent logs or claims and that the true scale may be larger.