Attackers used autonomous artificial-intelligence agents to break into online retail sites, plant payment-card skimmers, and steal more than 600,000 credit-card records. Gambit says the campaign has been active since at least July 2026 and used the Strix, Cairn, and Hermes open-source AI agent frameworks to scan for targets, gain access, inject skimmer code into checkout flows, tamper with JavaScript, S3/CDN assets, databases, Kubernetes deployments, and caches, and even wipe Magento card-data fields after exfiltration.
Why it matters: This is a large-scale payment theft campaign affecting online shoppers and e-commerce operators, and it shows AI agents can lower the cost of running broad, fast-moving attacks. Retailers should urgently inspect checkout code, third-party assets, cloud storage, and container deployments for skimmers and persistence, while affected users should monitor cards for fraud and replace them if notified.
2026.09.24
97% relevant
This appears to be the same underlying campaign and adds concrete operational details from Gambit’s reconstruction: the attacker used Hermes, Strix, and Cairn via OpenRouter, spent roughly $12,000 to $18,000, launched at least 105 attacks between September 10 and 15, and compromised at least 27 companies including a Fortune 500 hospitality company and a major U.S. airline.
Ionut Arghire
2026.09.24
97% relevant
This appears to be the same underlying campaign and adds concrete detail on the attack timeline, the use of Strix, Cairn, and Hermes AI tooling, at least 27 compromises between September 10 and 15, skimmer deployment methods, and additional victim types including hospitality, airline, industrial supplies, and fashion firms.
Bill Toulas
2026.09.23
100% relevant
This article appears to be the first concrete report establishing this specific AI-agent-driven skimming campaign, including the named toolchain, attack methods, and reported theft scale.
← Back to all stories