Threat actors used the open-source Cairn AI platform to hack more than 100 organizations and target e-commerce payment systems

Updated: 2026.10.20 14H ago 1 sources

Threat Actors & APTs Malware Scams & Fraud

Attackers used the open-source Cairn AI platform to automate intrusions against hundreds of websites and reportedly breached more than 100 organizations, including John Deere and SharkNinja. Norforge says at least three threat-actor clusters abused Cairn for persistent access, web shell deployment, admin and database access, and theft of credit-card and cryptocurrency data. The largest cluster ran more than 1,100 attack projects across 14 dashboards and targeted e-commerce and payment infrastructure in the US, Japan, and Australia.

Why it matters: This shows AI agent platforms are being used in real attacks at meaningful scale, especially against online commerce and payment systems. Organizations running internet-facing retail and payment services should look for web shells, exposed admin access, and compromised secrets, and review monitoring for automated reconnaissance and browser-driven testing.

Sources

AI Platform Cairn Abused to Hack Over 100 Organizations

Ionut Arghire 2026.10.20 100% relevant

This article appears to be the first clear report tying a specific AI platform, Cairn, to a named multi-cluster attack campaign affecting over 100 organizations.