AI Agents Took 600,000 Card Records From Online Retailers at About $25 a Target, Gambit Says

Update, Oct. 23: A month on, Gambit co-founder Sa’ar Elias told Dark Reading that “work that would previously have required a coordinated team of skilled attackers can now be carried out by one person without much prior knowledge,” and urged companies to focus on protecting the business processes they can’t operate without.

A financially motivated attacker who appears to be Chinese-speaking used three open-source AI agent tools to break into online retailers and take more than 600,000 unexpired credit card records, according to a report from Gambit Security.

Gambit recovered the operator’s staging server, which Forbes reported had been left accessible on the web, and rebuilt the campaign from it. Between Sept. 10 and 15 alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees. The activity goes back to July and was still running when Gambit published on Tuesday. Eyal Sela, Gambit’s director of threat intelligence, told Forbes it is one of “the most severe abuses of AI for exploitation seen so far.”

Who was hit

The card records came from two companies. Gambit also found skimmer scripts on the websites of five victims and some level of access to a Fortune 500 hospitality company, a major U.S. airline, a large private U.S. industrial supplies distributor and a U.S. online fashion retailer. Forbes said smaller targets included a Minnesota gun dealership and an Illinois beauty retailer. Fraud specialist Overwatch Data, which is notifying card issuers, counted 488,372 U.S. cards, or 79% of the total, with the rest spread across more than 200 other countries, led by the UAE with 13,559.

Three agents, a few prompts

Strix, an open-source AI penetration testing tool, handled vulnerability hunting. Between Aug. 23 and 31 it ran 146 times in “deep mode” against 138 hosts, logging 633 hours of scanner time through OpenRouter on GLM 5.2 and later DeepSeek v4 Pro. Cairn, an autonomous exploitation engine running on DeepSeek v4.1 Flash, took a target and an objective such as a shell or admin access and kept going for hours until it succeeded, timed out or was stopped.

Hermes, an open-source agent with persistent memory and skills it writes itself, ran the show. The operator loaded it with a Chinese persona titled “SOUL – Red Team Operator” and 121 skills, 78 of them for attacks, plus one meant to strip Hermes’ own content filters. It used Anthropic’s Claude Opus 4.6 after newer models refused its requests, and Anthropic told Forbes it had identified and banned the account. The human typed 1,951 prompts across 260 sessions, mostly short Chinese instructions such as “read the vulnerability report and start” and “can it get code execution?” in Gambit’s translation.

The bill was small. A capture of the OpenRouter account on Aug. 25 showed $7,005.71 spent over four weeks, and Gambit estimates the full campaign cost $12,000 to $18,000. The operator’s own cost review put the mean at $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive.

Skimmers and wiped tables

Skimmers were ordered against at least 27 named victims and confirmed on 19 of them, and with researcher Varys, Gambit found more than 100 other infected sites. BleepingComputer puts the total at 119 or more. The most common trick was appending a loader to a jQuery or Bootstrap file the site already served and restoring the file’s timestamp. Others went into a Google tag block, an S3 bucket behind a store’s CDN or a Kubernetes initContainer, and at a U.S. wine retailer a cron job checked every two minutes and re-added the skimmer whenever a redeploy removed it.

The agents also destroyed data. A Hermes skill titled “Database Wipe After Extraction” told the agent: “After extracting and downloading all card data, wipe the source fields in batches.” At a bicycle retailer, a cleanup step dropped 180 tables whose names matched “ZQ” or “Backup,” including backup tables the store’s own administrators had made, SecurityWeek and Gambit reported.

Gambit said it has contacted many of the affected organizations and worked with the Shadowserver Foundation and others to take down the infrastructure. Cloudflare told Forbes it has been shutting down the attacker’s servers, though Sela said new ones went up quickly. Gambit’s advice to defenders is to assume data loss can arrive as a side effect of someone else’s cleanup routine and to work out which systems make up their “minimum viable business.”