A financially motivated threat actor has been using three open-source AI harnesses (tools that coordinate and run AI tasks autonomously) to conduct low-cost, automated attacks against companies, particularly online retailers.
In its research shared with Hackread.com, Gambit Security researchers recovered an exposed staging server that revealed an ongoing campaign running since July 2026.
The attacker’s own review calculated an average cost of $25.46 across 101 completed scans, ranging from $3.13 to $79.31 per target, with the tools used to steal payment details and compromise web applications.
Between September 10 and 15, the operator initiated 105 attack projects and compromised at least 27 companies to varying degrees. Identified targets included an online fashion retailer, a Fortune 500 hospitality company, a major US airline, and a large US industrial supplies distributor.
The operation relied on three open-source AI harnesses working together with minimal manual input, including Strix, Cairn, and Hermes.
According to Gamnit Security’s blog post , human input remained sparse. Across 260 Hermes sessions, the operator typed 1,951 short commands in Chinese, often telling the agent to review a vulnerability report, test access, investigate an API or continue after gaining access.
In one documented attack chain, the agent used an SQL injection to obtain a plaintext one-time password, access a web panel, upload a web shell, escalate privileges through a misconfigured sudo rule, and access AWS credentials .
Researchers said the low cost and speed of the attacks were particularly impactful. Each target cost only tens of dollars, while successful intrusions usually took less than one day and sometimes only a few hours, creating what they described as “a remediation clock most organizations cannot hold.”
The campaign resulted in more than 600,000 unexpired credit card records being exfiltrated from two companies. The operator ordered skimmer deployments against at least 27 named victims, with malicious scripts confirmed on 19 websites. Researchers also identified more than 100 additional sites infected with skimmers associated with the campaign.
These skimmers were deployed in several ways, including by appending malicious code to legitimate JavaScript libraries, placing scripts in checkout pages, poisoning AWS S3 content, and modifying database content.
At one US wine retailer, a cron job checked the affected file every two minutes and restored the malicious code after the application redeployed a clean version.
This activity also caused data loss. A Hermes skill titled “Database Wipe After Extraction” instructed the agent to clear payment data from Magento databases after card information was downloaded. At a bicycle retailer, an automated cleanup routine dropped 180 tables matching specific prefixes, including backup tables created by the victim’s administrators.
Gambit Security worked with the Shadowserver Foundation and other industry partners to notify affected organisations and take down infrastructure linked to the campaign. The campaign shows that open-source AI agents can now perform reconnaissance, exploitation, persistence, payment-data theft, and destructive cleanup with limited human direction.
Your email address will not be published. Required fields are marked *