A financially motivated threat actor has been deploying AI agents as credit card skimmers, compromising at least 119 websites and stealing more than 600,000 payment card records, all while keeping the per-target cost under $80. The campaign has been active since at least July and was still ongoing as of 22 September, according to findings from cybersecurity startup Gambit.
The operation runs on three open-source AI agent frameworks working in sequence. Strix handles scanning and vulnerability discovery. Cairn functions as an autonomous exploitation engine, tasked with objectives such as obtaining a shell or admin access. Hermes, the orchestration layer, manages post-exploitation work, tactical decisions, and campaign-level direction, and it runs on Anthropic‘s Claude Opus 4.6. According to The Next Web, Hermes held 121 skills in total, 78 of them attack-related, and carried a persona called ‘SOUL, Red Team Operator’.
The human operator, who Gambit researchers say appears to be Chinese, gave the agents brief instructions on the operation’s goals and largely left them to it. Between 10 and 15 September, the attacker launched 105 distinct attack waves, succeeding to varying degrees on at least 27 targets. Strix ran 146 times against 138 hosts between 23 and 31 August, accumulating 633 scanning hours in that window alone.
AI Agents as Credit Card Skimmers: How the Attack Chain Worked
Once inside a target, the attacker injected skimmer code through whichever method the level of access permitted: appending malicious code to legitimate JavaScript files, adding script tags to checkout pages or Google Tag blocks, poisoning S3 and CDN content, modifying database fields, altering Kubernetes deployments, or using cron jobs to restore the skimmer if it was removed. That last technique proved particularly persistent. The Next Web reports that at one US wine retailer, a cron job was configured to reinstall the skimmer every two minutes after the site was redeployed, meaning a clean rollback was not enough on its own to clear the infection.
The attacker also instructed the AI agent to run cleanup procedures after exfiltrating card data. One of Hermes’s skill files contained the instruction: ‘After extracting and downloading all card data, wipe the source fields in batches.’ This caused operational disruptions at several retailers due to data losses, Gambit notes, a side effect defenders had not necessarily anticipated.
Gambit researchers gained access to a staging server operated by the attacker and retrieved direct evidence of the campaign’s reach. Breached organisations include a Fortune 500 hospitality company, a major US airline, a large US industrial supplies distributor, and an online fashion retailer. The attacker used a website traffic-ranking service to shortlist high-value targets from what Strix produced, and prioritised those running custom software, presumably because they were more likely to carry exploitable vulnerabilities.
Low Costs, High Volume and a Predominantly American Victim Pool
Of the more than 600,000 valid card records stolen, 79% belonged to US cardholders, according to The Next Web, reflecting both the targeting priorities and the concentration of large US retailers in the victim list. Despite the scale of the theft, the financial cost to the attacker was modest. Gambit researchers found an OpenRouter account showing $7,005.71 spent over roughly four weeks as of 25 August. Based on subsequent usage, they estimate total costs at between $12,000 and $18,000.
The operator’s own cost review gives a mean of $25.46 per completed scan, across 101 scans, ranging from $3.13 for the cheapest target to $79.31 for the most expensive. ‘Spread over the companies attacked, this is a marginal cost of a few US dollars to a few tens of US dollars for each targeted company,’ Gambit explains.
What is also worth clocking is how little direct involvement the human operator actually needed. The Next Web reports that the operator typed 1,951 prompts across 260 sessions, a low enough workload to suggest the agents were handling the bulk of reconnaissance, exploitation, and data management autonomously, with the human providing occasional course corrections between runs. In many cases, access was obtained within a few hours.
Gambit warns that organisations defending against this type of campaign need to account not just for data theft but for potential data loss as a side effect of the attacker’s cleanup routine, the wipe instruction makes the skimmer’s presence destructive as well as extractive. With AI agents driving both the volume and the speed of attacks, patching and monitoring alone are no longer a complete answer.
