AI Agents Turned Retail Skimming Into a Low-Cost Cybercrime Pipeline

AI Agents Turned Retail Skimming Into a Low-Cost Cybercrime Pipeline

A financially motivated operator has shown what happens when commodity offensive automation is wired into the economics of online payment theft. According to research reported by BleepingComputer, Gambit Security traced an ongoing campaign in which open-source AI agent frameworks were used to attack online retailers at scale, steal more than 600,000 valid card records, and infect more than 100 sites with payment skimmers.

The headline is not that attackers used automation. Cybercrime crews have automated scanning, credential abuse, and web skimming for years. The shift is that the operator appears to have delegated large parts of the attack lifecycle to a chain of specialized AI tools: one for vulnerability discovery, one for exploitation, and one for orchestration and post-compromise work. That lowers the cost of probing long-tail retail targets and changes how defenders should think about noisy attacks that suddenly become persistent, adaptive, and cheap.

What happened

The campaign has reportedly been active since at least July 2026 and was still ongoing as of September 22. In one five-day window between September 10 and September 15, the operator launched 105 attack waves and compromised at least 27 companies to varying degrees. The highest-confidence theft identified so far involves more than 600,000 unexpired payment cards taken from two victim companies, alongside skimmer deployments on additional retail sites.

Gambit's reconstruction is unusually useful because researchers obtained visibility into attacker infrastructure rather than relying only on victim-side telemetry. That staging-server view exposed the tools, prompts, costs, and operational rhythm behind the campaign.

The attack pipeline reportedly used three open-source AI tools:

• Strix for reconnaissance and vulnerability discovery across target hosts.
• Cairn as an autonomous exploitation engine tasked with goals such as obtaining shell or administrative access.
• Hermes for orchestration, post-exploitation, tactical decisions, scheduled jobs, and cleanup.

SecurityWeek reported that Strix ran 146 times against 138 hosts between August 23 and August 31, while the later exploitation phase launched 105 attack projects in mid-September. Hermes reportedly carried a "Red Team Operator" persona and 121 skills, including 78 attack-related skills. The human operator issued short Chinese-language instructions and let the agent chain handle much of the work between prompts.

Why this belongs in cybercrime, not just AI risk

It is tempting to file this story under generic "AI security." That misses the practical point. The dominant outcome here is payment-card theft, online store compromise, skimmer persistence, and criminal monetization. The category is cybercrime, with AI acting as the force multiplier.

The campaign's economics matter as much as its tooling. BleepingComputer reports that Gambit found an OpenRouter account with roughly $7,000 spent over about four weeks and estimated total costs of $12,000 to $18,000 for the recent phase. The mean cost came out to about $25 per target across 101 completed scans.

That figure is the uncomfortable part. If attackers can turn reconnaissance, exploitation attempts, skimmer insertion, and post-compromise cleanup into a mostly repeatable workflow at tens of dollars per target, many smaller e-commerce environments become worth probing. Sites that once felt too niche to attract hands-on attention may still be profitable when the marginal cost of trying is so low.

The skimmer paths were familiar, but the tempo changed

The individual techniques described in the reporting are not exotic. The campaign used the same sorts of weaknesses defenders already know: SQL injection, insecure file upload paths, exposed credentials, weak plugin hygiene, and administrative access to content or checkout infrastructure.

What changed was the compression of those steps into an agent-driven workflow. CSA's analysis described one intrusion chain that moved through unauthenticated SQL injection, MFA bypass, arbitrary file upload, remote code execution, privilege escalation, exposed WordPress credentials, malicious plugin upload, AWS Secrets Manager access, Magento database access, encryption key extraction, and card-data decryption. None of those pieces is new by itself. The notable development is that a lightly supervised system could connect them across unrelated victims at speed.

Once inside, the operator deployed skimmers in several ways:

• appending malicious code to legitimate JavaScript files served to checkout pages
• adding script tags to checkout templates or Google tag blocks
• poisoning S3 buckets, CDN content, and server-side caches
• modifying database fields that feed rendered checkout pages
• altering Kubernetes deployment configurations
• using cron jobs to reinsert skimmers after removal

That last behavior is especially important for response teams. A skimmer that reappears after deletion is not just an incomplete cleanup task. In this campaign, it could signal autonomous orchestration that is actively restoring attacker changes on a schedule.

Cleanup automation created its own blast radius

The campaign also shows how attacker automation can create destructive side effects. Gambit reportedly found instructions telling Hermes to wipe source card fields from Magento databases after exfiltration. CSA noted that cleanup routines destroyed legitimate backup tables at one victim when the automation matched names containing backup-related strings.

That matters for incident response. A human attacker trying to remain quiet may still make mistakes, but autonomous cleanup logic can move faster than a human investigation and damage evidence or recovery options before responders understand the full chain. For defenders, immediate backup preservation is not a paperwork detail; it becomes a containment step.

Teams handling suspected retail compromise should snapshot relevant databases, object storage, web roots, CDN configuration, and deployment manifests before repeated cleanup attempts erase the trail. This is also a strong argument for immutable, tested backup security rather than backups that sit inside the same administrative blast radius as production data.

What defenders should do now

Retailers and payment processors should treat this campaign as a reason to audit the checkout surface, not as a reason to panic about AI in the abstract.

Start with the assets attackers modified in this case. Review checkout JavaScript, tag managers, CDN and S3 objects, database-rendered content fields, template files, Kubernetes manifests, and application-server cron jobs. Look for recently modified files, unfamiliar script tags, unexpected destinations receiving payment-form data, and skimmer code that returns after removal.

Then move to the root causes. Confirm that Magento, WordPress, plugins, extensions, upload handlers, and custom checkout code are patched and monitored. The relevant defensive program is still application security, access control, credential hygiene, and change detection. AI changes the attacker's tempo, but it does not remove the need to close ordinary web application weaknesses.

Detection teams should also tune for behavior, not just specific indicators. The tooling described in this campaign was built from open-source agent frameworks, so defenders may not get a stable malware family name or a single hash to block. Better signals include checkout asset drift, repeated skimmer restoration, new scheduled jobs near web paths, unusual administrative changes to tag managers, unexpected reads from secrets stores, and database access patterns focused on payment tables.

The strategic lesson

The most useful takeaway is sober: agentic tooling makes broad, adaptive cybercrime more affordable. A solo operator can now behave more like a small distributed intrusion team, with separate components handling recon, exploitation, persistence, and cleanup.

For defenders, that means low-value assumptions need revision. A small storefront, abandoned microsite, legacy checkout plugin, or custom integration can still become part of a profitable card-theft campaign if the attacker's cost to test it is only a few dollars. Exposure management should prioritize externally reachable systems that touch payments, secrets, customer data, or administrative control planes, even when those systems do not look like crown jewels on a traditional asset list.

The right response is not to chase every AI-branded claim. It is to make the checkout path harder to modify invisibly, shorten detection time for unauthorized changes, preserve recoverable backups outside the attacker's reach, and assume that some criminal workflows now move at software speed.

References

1. Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
2. AI-Powered Campaign Targets Hundreds of Online Retailers
3. Autonomous AI Agents Breach 100+ Retailers: Security Implications