#
- Basic Information
- Original Title: Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign
- Published Date: 2026-09-22
- Updated Date: None
- Collected Date: 2026-09-24T08:09:37+09:00
- Source: Gambit Security
- Severity: critical
- Type: Threat Intelligence
- Target Period: 2026-09-23T08:14:06+09:00 - 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
- Original Link: Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign
- Related Sources: BleepingComputer: Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
- Basis for Severity: Gambit reported 105 attack projects and at least 27 compromised companies. Over 600,000 unexpired payment card records were stolen from two companies, and card-skimming scripts along with data deletion were confirmed. Some individual actions are evaluated based on agent reports and execution logs.
- Reason for Update: Separated attack cases from skimmer installation paths, clarified Gambit's evidence categories, observation denominators, and human instructions. Updated MITRE ATT&CK mapping for sudo and cloud secrets, and revised Japanese phrasing.
#
- Executive Summary
Gambit reported an ongoing campaign where human-directed AI agents named Hermes, Strix, and Cairn automated much of multi-stage retail site breaches and payment skimmer deployments. Gambit confirmed the theft of over 600,000 unexpired payment card records from two companies. Skimmer deployment was confirmed on 19 targets, with more than 100 additional related sites identified.
#
- Attack Flow
Case A: From SQL Injection to Database Card Data
- A human attacker sets targets and goals, and the agents explore entry paths. In one Gambit case, the agent read a one-time password (OTP) from a pre-authentication SQL injection and accessed the admin panel.
- The agent moved from file upload to remote code execution on the host, abusing sudo NOPASSWD settings to gain root privileges.
- It retrieved WordPress database credentials from an internal NFS share, added an administrator, uploaded a plugin, and executed code on an adjacent blog host.
- Recovered project logs show it retrieved 46 secrets from AWS Secrets Manager, reaching the Magento database hosted on Amazon Aurora and subsequently obtained the Magento encryption key.
Skimmer Deployment and Post-Exploitation Across Multiple Victims
- Gambit reported varying installation methods per victim, including JavaScript appending, tag scripts, S3/CDNs, database contents, Kubernetes initContainers, server-side caching, and cron-based re-deployment. These were not executed sequentially on all targets.
- Operations such as restoring timestamps of existing files and deleting data after card theft were recorded.
- At another bicycle retailer, cleanup of staging tables deleted 180 tables matching ZQ or Backup, destroying victim-side backup tables as well.
#
- Attacker Location and Execution Context
- External attacker reaching public web applications
- Post-compromise Linux/WordPress/Magento administrator or OS shell
- Post-compromise access to cloud secrets, Kubernetes, and NFS resources
- Operator directing and evaluating multiple AI agents
#
- Victim and Administrator Perspective
Victims
- Checkout pages display normally while card data is silently exfiltrated in the background
- During outages, business impact surfaces through database table deletions
Administrators and SOCs
- Vulnerability scans, admin logins, file uploads, sudo usage, NFS mounts, Secrets Manager reads, and skimmer modifications are scattered across logs of different products
- File timestamps are restored, which can cause simple mtime monitoring to miss tampering
#
- Success and Failure Conditions
Success Conditions
- Public web applications contain exploitable vulnerabilities or weak administrative interfaces
- Acquired shells provide pathways to the next stage via sudo, NFS, or cloud secrets
- Payment assets and distribution infrastructure can be modified
- Outbound communication to card data exfiltration destinations is allowed
Failure Conditions and Mitigations
- Prompt patching of public assets and use of WAF/virtual patching
- Principle of least privilege for admin panels and file uploads, and protection of OTP storage and validation mechanisms
- Elimination of NFS no_root_squash and excessive sudo permissions
- Isolation of Secrets Manager, database, CDN, and Kubernetes credentials
- Integrity monitoring for checkout page assets and implementation of CSP
#
- Impact of Successful Attacks
- Confirmation of over 600,000 stolen payment card records
- Skimmer deployment confirmed on 19 targets, with over 100 related skimmer-infected sites identified
- Theft of cloud secrets and database credentials
- Lateral movement across multiple systems
- Destruction and evidence removal including database table deletion
#
- Observable Logs
- No email usage was reported in the initial compromise of this case
Proxy / SWG / DNS
- Traffic to AI agent working servers, C2 servers, or skimmer collection endpoints
- POST requests from checkout pages to new external domains
Endpoint / EDR
- Web processes spawning shells, curl, wget, sudo, mount, cloud CLI, kubectl, and similar tools
- Modifications and timestamp manipulation on web roots, plugins, and tag scripts
Identity / IdP
- Administrator logins following abnormal OTP reads
- Rapid authentication spanning multiple administrative panels and cloud roles
SaaS / Cloud
- Mass enumeration/reading in Secrets Manager
- S3/CDN object updates
- Kubernetes deployment modifications
- Abnormal queries and table deletions on Aurora/databases
Network
- Automated reconnaissance and SQLi against public web servers
- NFS connections and lateral movement to internal WordPress/Magento instances
- Card data transmission from shoppers’ browsers to collection servers
#
- Attack Success Assessment
Confirmed in Public Information
Subsequent Compromise Confirmed : Gambit directly confirmed stolen card data and active skimmers, reporting at least 27 company compromises and data deletions. Some individual actions are evaluated through agent reports and execution logs rather than independent re-verification. Scope: Recovered attack infrastructure and verified victim sites. The numbers 27 companies, 19 instances, and over 100 sites represent different metrics.
#
- Investigation Playbook
Triggers
- Checkout tampering, unknown exfiltration destinations, abnormal Secrets Manager reads, web process-initiated shells, database table deletions
Initial Verification
- Normalize timestamps across web servers, WAFs, authentication, cloud audit logs, and EDRs to UTC
- Preserve historical data for checkout assets, CDNs, and S3 objects
- Cross-search for IoCs and related operations originating from agent working servers
Endpoints and Servers
- Check web process lineage, sudo usage, mounts, plugin/file uploads, and timestamp modifications
- Inspect NFS export configurations and the use of no_root_squash
Authentication and Cloud
- Trace OTPs, admin logins, role assumptions, secret access, and Kubernetes modifications
- Identify secrets accessible from compromised privileges within your organization and revoke/re-issue them. The figure of 46 secrets applies to a specific reported case.
Subsequent Operations
- Verify WordPress/Magento lateral movement, S3/CDN tampering, database card data, and skimmer transmission destinations
- Audit create and delete operations, including tables matching ZQ or Backup
Containment
- Revert checkout distribution to a known good version and block external exfiltration
- Isolate compromised hosts, update and revoke secrets, keys, and sessions
- Minimize NFS, sudo, and cloud IAM permissions
Severity Classification
- Categorize reconnaissance as contact, shell acquisition as initial execution, secret/card data acquisition as data theft, and skimmer deployment or database deletion as subsequent compromise
#
- Defense and Detection Ideas
Single Events
- Execution of sudo, mount, aws, or kubectl from web processes
- Data transmission from checkout JavaScript to unknown domains
- High-volume GetSecretValue calls in Secrets Manager within a short timeframe
Timeline Correlation
- Correlate SQLi -> OTP read -> admin login -> file upload -> shell -> sudo -> secret access
- Correlate checkout asset modification -> timestamp restoration -> external POST request
Threat Hunting
- Search for the creation/deletion of tables whose names match the observed ZQ or Backup naming patterns, and check for identical skimmer code snippets across multiple distribution surfaces
Log Gaps
- Gaps in CDN/S3 modification history, NFS logs, tag management, or checkout page observation records make identifying installation paths difficult
Priority Countermeasures
- Management of external-facing public assets
- Breaking the privilege chain
- Automation of secret rotation and revocation
- Integrity monitoring of checkout pages and application of CSP and SRI based on distribution pathways. Additional verification is required for authorized scripts or same-origin tampering.
- Isolation of database backups
#
- Facts / Inference / Hypothesis
Facts
- Gambit based its findings on stolen data and tools recovered from attacker working servers, real-world site skimmers, agent reports, and execution logs. Some actions could not be independently verified and were evaluated alongside other corroborated records.
- Between September 10 and 15, 2026, 105 attack projects were created, of which 48 were analyzable and 57 had been deleted. Gambit reported that at least 27 companies suffered varying degrees of compromise.
- Hermes, Strix, and Cairn automated the attacks, but humans provided targets, objectives, and subsequent instructions. This does not imply completely human-free attacks.
- Over 600,000 unexpired payment card records were stolen from two companies. Skimmer deployment was instructed for at least 27 named targets and confirmed in 19 instances. Separately, over 100 sites infected with related skimmers were found.
- In one project, the recorded path progressed through SQL injection, OTP reading, file upload, sudo, NFS, WordPress, AWS Secrets Manager, Aurora, and Magento encryption keys. This path was not shared by all victims.
- Estimated model API costs were $12,000 to $18,000 USD, with an average of $25.46 USD per target across 101 completed scans.
- Evidence-removal instructions included payment database deletion, with one agent deleting 180 ZQ or Backup tables.
- Gambit noted suspicious script distribution from a Japanese travel booking site as an example of a related skimmer.
Inference
- Autonomous execution lowers the unit cost per target, enabling attackers to test long compromise chains and making medium-sized retailers—previously filtered out by human labor—viable targets.
- Preserving agent dialogue, execution logs, and tool artifacts can help reconstruct not only individual vulnerabilities but also attacker objectives and automated decision-making processes.
Hypothesis
No additional hypotheses. Unverified items are listed under 'Gaps and Additional Research'.
#
- MITRE ATT&CK Mapping
| ID | Technique | Confidence | Basis | | T1190 | Exploit Public-Facing Application | high | Automated discovery and exploitation of pre-authentication SQL injections and other vulnerabilities. | | T1548.003 | Abuse Elevation Control Mechanism: Sudo and Sudo Caching | high | Privilege escalation abusing Python execution via sudo NOPASSWD. Distinct from vulnerability exploitation. | | T1552.001 | Unsecured Credentials: Credentials In Files | high | Retrieving credentials from configuration files such as wp-config.php. | | T1078 | Valid Accounts | high | Logging into administrative panels using OTPs and administrative credentials. | | T1056.003 | Input Capture: Web Portal Capture | high | Capturing card input via payment skimmers. | | T1070.006 | Indicator Removal: Timestomp | high | Restoring timestamps after file tampering. | | T1485 | Data Destruction | high | Destruction via database table deletion. | | T1555.006 | Credentials from Password Stores: Cloud Secrets Management Stores | high | Retrieving secrets from AWS Secrets Manager. |
#
- Gaps and Additional Research
- Total number of victim organizations, industry sectors, and geographical distribution
- Number of stolen cards among the 600,000+ that were actually used fraudulently
- Operator attribution and modifications to the agent execution infrastructure
- Initial intrusion vulnerabilities per target
- Undisclosed skimmer collection endpoints
#
- Impact on SOCs and Organizations
The intrusion paths shown by Gambit varied by victim, with multiple agents pursuing reconnaissance based on short human instructions. E-commerce and retail organizations must remove excessive privileges and restrict access between systems spanning web servers, operating systems, NFS shares, cloud environments, and payment assets, while correlating logs across each environment. Because a Japanese travel booking site was also included as an example of a related skimmer, verifying checkout page distribution sources and change histories remains a concrete investigation task.
#
- Target Audience Summary
SOC
Integrate public web, host, cloud, and payment logs to detect multi-stage privilege chains and skimmer exfiltration.
Administrators
Segregate sudo, NFS, cloud secrets, and CDN permissions, and monitor payment assets for tampering.
End Users
Since tampering is difficult for users to spot independently, regularly review credit card statements and promptly report suspicious transactions, and follow notifications from merchants.