A financially motivated threat actor is using open-source AI agent frameworks to automate attacks against hundreds of online retailers and steal more than 600,000 credit card records. The campaign, active since at least July, has compromised at least 119 websites with card skimmers and relied on Strix, Cairn, and Hermes to carry out scanning, exploitation, and orchestration at scale. #Strix #Cairn #Hermes #Gambit
Keypoints
- The attacker used AI tools to automate attacks against online retailers.
- More than 600,000 valid credit card records were stolen from two companies.
- At least 119 websites were compromised with card skimmers.
- The campaign used Strix, Cairn, and Hermes for scanning, exploitation, and orchestration.
- Gambit found low per-target costs and evidence of cleanup steps that removed card data after exfiltration.