AI-Powered Cybercrime Campaign Steals 600K+ Credit Cards from Online Retailers A financially motivated threat actor has leveraged autonomous AI agents to target hundreds of online retailers since July 2026, stealing over 600,000 unexpired credit card records in an ongoing campaign uncovered by Gambit Security. The operation, which remains active, automates vulnerability discovery, exploitation, data theft, and payment card skimming with some attacks including destructive cleanup actions that erase database tables or wipe payment fields post-exfiltration. ### Attack Mechanics & AI Tools The campaign employs three open-source AI agents: - Strix: Conducts deep reconnaissance and vulnerability scanning. - Cairn: Executes autonomous exploitation, securing shell or admin access over hours. - Hermes: Orchestrates attacks, maintains persistence, and directs impact-stage actions. A human operator, issuing brief prompts in Chinese, initiated attacks by directing agents to probe targets, validate exploits, and deploy JavaScript skimmers often by hijacking legitimate scripts, modifying Google Tag Manager, or poisoning cloud-hosted content. Between September 10–15, 2026, the actor launched 105 attack projects, compromising at least 27 organizations. ### Cost & Scale The operator used OpenRouter for AI model access, spending $7,005.71 over four weeks with estimated total campaign costs between $12,000–$18,000. The average cost per successful target was $25.46, though expenses ranged from $3.13 to $79.31 depending on the attack’s complexity. ### Techniques & Impact Beyond skimming, the threat actor employed destructive automation, including: - Wiping Magento payment card fields after exfiltration. - Deleting 180 database tables (including backups) via broad cleanup criteria. The campaign highlights how AI-driven tools accelerate attacks, reducing the time between exposure and compromise while enabling a single operator to manage large-scale intrusions. ### Indicators of Compromise (IoCs) Gambit Security identified multiple IPs, domains, and skimmer payloads linked to the operation, including: - Staging/C2 IPs: `155.254.22.215`, `209.126.4.170`, `213.21.239.62` - Skimmer hosts: `b8t[.]shop`, `cdn[.]netlfjs[.]com`, `x1opay[.]co` - Proxy services: IPRoyal, 711proxy, 1024proxy The full list of IoCs is available in the original report.