Autonomous AI agents compromised at least 119 retail websites with card-skimming code and stole more than 600,000 valid credit card records from two of the victim companies, according to a report security research firm Gambit Security published Sept. 22. Eyal Sela, Gambit’s director of threat intelligence and the report’s author, said the attacks ran from July through at least mid-September, with the busiest stretch, Sept. 10-15, alone producing 105 separate attack attempts against at least 27 companies. Unlike earlier automated hacking tools, Gambit said, the agents chained scanning, exploitation and post-breach orchestration into a single pipeline that required little human direction once launched.
Inside the kit: The Senior Fraud Defense & First-Hour Recovery Kit lays out the free credit-freeze steps and the family code word for confirming a real bank call after a retailer breach like the one researchers just detailed. Start the free credit-freeze steps →
How the count reached “at least 119” sites
Gambit’s report, “AI Agents Are Hacking Online Retailers for $25 a Company,” said skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them during the campaign window. Working with an outside researcher identified only as Varys, Gambit said it then found “more than 100 further websites infected” with a skimmer tied to the same campaign, a figure that combines with the 19 confirmed sites to produce the at-least-119 total. More than 600,000 credit card records were stolen from two of the compromised companies alone, Gambit said, of which 488,372, or 79 percent, carried U.S.-issued cards.
The three AI tools that ran the operation
Gambit named three purpose-built agents working in sequence: Strix, a vulnerability scanner that logged 146 scanning runs; Cairn, described as an “autonomous exploitation engine” tasked with objectives such as obtaining a shell or administrator access once a weakness was found; and Hermes, an orchestration agent with persistent memory and a library of 121 skills, 78 of them built specifically for attacks, that managed the campaign end to end and deployed the actual skimming code. Hermes ran on Anthropic’s Opus 4.6 model, the report said, while Strix used GLM 5.2 and later DeepSeek v4 Pro, and Cairn ran on DeepSeek v4.1 Flash, all accessed through the OpenRouter model marketplace rather than a single vendor’s platform.
How the skimming code reached checkout pages
Once inside a target’s systems, the agents planted card-stealing code through several routes Gambit said it observed directly: appending malicious script to legitimate JavaScript files already loaded by a site, inserting new script tags on checkout pages, poisoning content served through a company’s S3 storage or content-delivery network, and in some cases altering database fields or Kubernetes deployment configurations to keep the skimmer running after a partial cleanup. Named targets described in the report included a Fortune 500 hospitality company, a major U.S. airline, a large industrial-supplies distributor and an online fashion retailer, a spread that shows the technique was not limited to small or poorly resourced merchants. The payment industry’s own standards body has been pushing merchants toward exactly the kind of checkout-page monitoring this campaign evaded: the PCI Security Standards Council’s payment-page security guidance calls for merchants to inventory every script that loads on a checkout page and flag any change to that list, a control this campaign’s mix of altered JavaScript files, poisoned CDN content and modified Kubernetes deployments was specifically built to slip past.
A few dollars per target, thousands per campaign
Gambit put the average cost of a single completed attack at $25.46 across 101 scans it tracked, and estimated the campaign had run up roughly $7,005.71 in AI-service costs over four weeks as of Aug. 25, on pace for a full-campaign cost the firm projected at $12,000 to $18,000. Security reporter Bill Toulas, writing for BleepingComputer, was first to summarize the findings publicly on Sept. 23. Sela’s report argued that the low marginal cost, not any single new exploit, is what should worry defenders, since it lets an attacker relaunch against a fresh target within minutes of a failure at effectively no cost. That economics-first framing is also why Gambit’s recommendation to targets was not simply faster patching: the firm urged companies to identify which systems form a “minimum viable business” and confirm they can keep running, or recover quickly, even while an agent this fast and this cheap is actively inside the network.
What a shopper does with a card that may be in the batch
New Jersey’s state cybersecurity office, the NJCCIC, has separately described this style of checkout-page skimming as difficult for a shopper to spot in the moment, since the payment form itself looks unchanged even as it forwards card data to an attacker. Anyone who bought something from one of the named companies during the July-through-September window can ask the issuing bank to reissue the card, since a bank can cancel and replace a compromised card number without waiting for fraudulent charges to appear. The Federal Trade Commission’s identity-theft reporting portal and the Consumer Financial Protection Bureau’s victim guidance both walk through disputing an unauthorized charge and placing a fraud alert or credit freeze, steps that apply whether a card turns up in this batch of 600,000 or in the next one a different research firm eventually finds.
Locking down a card number after a retailer breach
Gambit’s researchers found AI agents planting skimmers on at least 119 shopping sites and pulling more than 600,000 card numbers, a scale of theft that leaves individual shoppers with no way to know whether their own card was in the batch until a bank flags an unfamiliar charge.
The Senior Fraud Defense & First-Hour Recovery Kit opens with the free credit-freeze steps and includes an account and device inventory for tracking every card and login tied to a retailer that turns up in a breach report.
Freeze credit and log affected accounts in The Senior Fraud Defense & First-Hour Recovery Kit.
This article was produced with AI assistance and checked against the primary sources linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
