Autonomous AI Agents Breach Online Retailers in Chained Attacks to Steal Payment Card Data

1. Basic Information

• Original Title: Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign
• Published Date: 2026-09-22
• Updated Date: None
• Collected Date: 2026-09-24T08:09:37+09:00
• Source: Gambit Security
• Severity: critical
• Type: Threat Intelligence
• Target Period: 2026-09-23T08:14:06+09:00 - 2026-09-24T08:09:37+09:00 (Asia/Tokyo)
• Original Link: Autonomous AI Agents are breaking into hundreds of Online Retailers for $25 a target in an ongoing campaign
• Related Sources: BleepingComputer: Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
• Basis for Severity: Gambit reported 105 attack projects and at least 27 compromised companies. Over 600,000 unexpired payment card records were stolen from two companies, and card-skimming scripts along with data deletion were confirmed. Some individual actions are evaluated based on agent reports and execution logs.
• Reason for Update: Separated attack cases from skimmer installation paths, clarified Gambit's evidence categories, observation denominators, and human instructions. Updated MITRE ATT&CK mapping for sudo and cloud secrets, and revised Japanese phrasing.

2. Executive Summary

Gambit reported an ongoing campaign where human-directed AI agents named Hermes, Strix, and Cairn automated much of multi-stage retail site breaches and payment skimmer deployments. Gambit confirmed the theft of over 600,000 unexpired payment card records from two companies. Skimmer deployment was confirmed on 19 targets, with more than 100 additional related sites identified.

3. Attack Flow

Case A: From SQL Injection to Database Card Data

1. A human attacker sets targets and goals, and the agents explore entry paths. In one Gambit case, the agent read a one-time password (OTP) from a pre-authentication SQL injection and accessed the admin panel.
2. The agent moved from file upload to remote code execution on the host, abusing sudo NOPASSWD settings to gain root privileges.
3. It retrieved WordPress database credentials from an internal NFS share, added an administrator, uploaded a plugin, and executed code on an adjacent blog host.
4. Recovered project logs show it retrieved 46 secrets from AWS Secrets Manager, reaching the Magento database hosted on Amazon Aurora and subsequently obtained the Magento encryption key.

Skimmer Deployment and Post-Exploitation Across Multiple Victims

1. Gambit reported varying installation methods per victim, including JavaScript appending, tag scripts, S3/CDNs, database contents, Kubernetes initContainers, server-side caching, and cron-based re-deployment. These were not executed sequentially on all targets.
2. Operations such as restoring timestamps of existing files and deleting data after card theft were recorded.
3. At another bicycle retailer, cleanup of staging tables deleted 180 tables matching ZQ or Backup, destroying victim-side backup tables as well.

4. Attacker Location and Execution Context

• External attacker reaching public web applications
• Post-compromise Linux/WordPress/Magento administrator or OS shell
• Post-compromise access to cloud secrets, Kubernetes, and NFS resources
• Operator directing and evaluating multiple AI agents

5. Victim and Administrator Perspective

Victims

• Checkout pages display normally while card data is silently exfiltrated in the background
• During outages, business impact surfaces through database table deletions

Administrators and SOCs

• Vulnerability scans, admin logins, file uploads, sudo usage, NFS mounts, Secrets Manager reads, and skimmer modifications are scattered across logs of different products
• File timestamps are restored, which can cause simple mtime monitoring to miss tampering

6. Success and Failure Conditions

Success Conditions

• Public web applications contain exploitable vulnerabilities or weak administrative interfaces
• Acquired shells provide pathways to the next stage via sudo, NFS, or cloud secrets
• Payment assets and distribution infrastructure can be modified
• Outbound communication to card data exfiltration destinations is allowed

Failure Conditions and Mitigations

• Prompt patching of public assets and use of WAF/virtual patching
• Principle of least privilege for admin panels and file uploads, and protection of OTP storage and validation mechanisms
• Elimination of NFS no_root_squash and excessive sudo permissions
• Isolation of Secrets Manager, database, CDN, and Kubernetes credentials
• Integrity monitoring for checkout page assets and implementation of CSP

7. Impact of Successful Attacks

• Confirmation of over 600,000 stolen payment card records
• Skimmer deployment confirmed on 19 targets, with over 100 related skimmer-infected sites identified
• Theft of cloud secrets and database credentials
• Lateral movement across multiple systems
• Destruction and evidence removal including database table deletion

8. Observable Logs

Email

• No email usage was reported in the initial compromise of this case

Proxy / SWG / DNS

• Traffic to AI agent working servers, C2 servers, or skimmer collection endpoints
• POST requests from checkout pages to new external domains

Endpoint / EDR

• Web processes spawning shells, curl, wget, sudo, mount, cloud CLI, kubectl, and similar tools
• Modifications and timestamp manipulation on web roots, plugins, and tag scripts

Identity / IdP

• Administrator logins following abnormal OTP reads
• Rapid authentication spanning multiple administrative panels and cloud roles

SaaS / Cloud

• Mass enumeration/reading in Secrets Manager
• S3/CDN object updates
• Kubernetes deployment modifications
• Abnormal queries and table deletions on Aurora/databases

Network

• Automated reconnaissance and SQLi against public web servers
• NFS connections and lateral movement to internal WordPress/Magento instances
• Card data transmission from shoppers’ browsers to collection servers

9. Attack Success Assessment

Confirmed in Public Information

• Subsequent Compromise Confirmed: Gambit directly confirmed stolen card data and active skimmers, reporting at least 27 company compromises and data deletions. Some individual actions are evaluated through agent reports and execution logs rather than independent re-verification. Scope: Recovered attack infrastructure and verified victim sites. The numbers 27 companies, 19 instances, and over 100 sites represent different metrics.

10. Investigation Playbook

Triggers

• Checkout tampering, unknown exfiltration destinations, abnormal Secrets Manager reads, web process-initiated shells, database table deletions

Initial Verification

• Normalize timestamps across web servers, WAFs, authentication, cloud audit logs, and EDRs to UTC
• Preserve historical data for checkout assets, CDNs, and S3 objects
• Cross-search for IoCs and related operations originating from agent working servers

Endpoints and Servers

• Check web process lineage, sudo usage, mounts, plugin/file uploads, and timestamp modifications
• Inspect NFS export configurations and the use of no_root_squash

Authentication and Cloud

• Trace OTPs, admin logins, role assumptions, secret access, and Kubernetes modifications
• Identify secrets accessible from compromised privileges within your organization and revoke/re-issue them. The figure of 46 secrets applies to a specific reported case.

Subsequent Operations

• Verify WordPress/Magento lateral movement, S3/CDN tampering, database card data, and skimmer transmission destinations
• Audit create and delete operations, including tables matching ZQ or Backup

Containment

• Revert checkout distribution to a known good version and block external exfiltration
• Isolate compromised hosts, update and revoke secrets, keys, and sessions
• Minimize NFS, sudo, and cloud IAM permissions

Severity Classification

• Categorize reconnaissance as contact, shell acquisition as initial execution, secret/card data acquisition as data theft, and skimmer deployment or database deletion as subsequent compromise

11. Defense and Detection Ideas

Single Events

• Execution of sudo, mount, aws, or kubectl from web processes
• Data transmission from checkout JavaScript to unknown domains
• High-volume GetSecretValue calls in Secrets Manager within a short timeframe

Timeline Correlation

• Correlate SQLi -> OTP read -> admin login -> file upload -> shell -> sudo -> secret access
• Correlate checkout asset modification -> timestamp restoration -> external POST request

Threat Hunting

• Search for the creation/deletion of tables whose names match the observed ZQ or Backup naming patterns, and check for identical skimmer code snippets across multiple distribution surfaces

Log Gaps

• Gaps in CDN/S3 modification history, NFS logs, tag management, or checkout page observation records make identifying installation paths difficult

Priority Countermeasures

• Management of external-facing public assets
• Breaking the privilege chain
• Automation of secret rotation and revocation
• Integrity monitoring of checkout pages and application of CSP and SRI based on distribution pathways. Additional verification is required for authorized scripts or same-origin tampering.
• Isolation of database backups

12. Facts / Inference / Hypothesis

Facts

• Gambit based its findings on stolen data and tools recovered from attacker working servers, real-world site skimmers, agent reports, and execution logs. Some actions could not be independently verified and were evaluated alongside other corroborated records.
• Between September 10 and 15, 2026, 105 attack projects were created, of which 48 were analyzable and 57 had been deleted. Gambit reported that at least 27 companies suffered varying degrees of compromise.
• Hermes, Strix, and Cairn automated the attacks, but humans provided targets, objectives, and subsequent instructions. This does not imply completely human-free attacks.
• Over 600,000 unexpired payment card records were stolen from two companies. Skimmer deployment was instructed for at least 27 named targets and confirmed in 19 instances. Separately, over 100 sites infected with related skimmers were found.
• In one project, the recorded path progressed through SQL injection, OTP reading, file upload, sudo, NFS, WordPress, AWS Secrets Manager, Aurora, and Magento encryption keys. This path was not shared by all victims.
• Estimated model API costs were $12,000 to $18,000 USD, with an average of $25.46 USD per target across 101 completed scans.
• Evidence-removal instructions included payment database deletion, with one agent deleting 180 ZQ or Backup tables.
• Gambit noted suspicious script distribution from a Japanese travel booking site as an example of a related skimmer.

Inference

• Autonomous execution lowers the unit cost per target, enabling attackers to test long compromise chains and making medium-sized retailers—previously filtered out by human labor—viable targets.
• Preserving agent dialogue, execution logs, and tool artifacts can help reconstruct not only individual vulnerabilities but also attacker objectives and automated decision-making processes.

Hypothesis

No additional hypotheses. Unverified items are listed under 'Gaps and Additional Research'.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1190	Exploit Public-Facing Application	high	Automated discovery and exploitation of pre-authentication SQL injections and other vulnerabilities.
T1548.003	Abuse Elevation Control Mechanism: Sudo and Sudo Caching	high	Privilege escalation abusing Python execution via sudo NOPASSWD. Distinct from vulnerability exploitation.
T1552.001	Unsecured Credentials: Credentials In Files	high	Retrieving credentials from configuration files such as wp-config.php.
T1078	Valid Accounts	high	Logging into administrative panels using OTPs and administrative credentials.
T1056.003	Input Capture: Web Portal Capture	high	Capturing card input via payment skimmers.
T1070.006	Indicator Removal: Timestomp	high	Restoring timestamps after file tampering.
T1485	Data Destruction	high	Destruction via database table deletion.
T1555.006	Credentials from Password Stores: Cloud Secrets Management Stores	high	Retrieving secrets from AWS Secrets Manager.

14. Gaps and Additional Research

• Total number of victim organizations, industry sectors, and geographical distribution
• Number of stolen cards among the 600,000+ that were actually used fraudulently
• Operator attribution and modifications to the agent execution infrastructure
• Initial intrusion vulnerabilities per target
• Undisclosed skimmer collection endpoints

15. Impact on SOCs and Organizations

The intrusion paths shown by Gambit varied by victim, with multiple agents pursuing reconnaissance based on short human instructions. E-commerce and retail organizations must remove excessive privileges and restrict access between systems spanning web servers, operating systems, NFS shares, cloud environments, and payment assets, while correlating logs across each environment. Because a Japanese travel booking site was also included as an example of a related skimmer, verifying checkout page distribution sources and change histories remains a concrete investigation task.

16. Target Audience Summary

SOC

Integrate public web, host, cloud, and payment logs to detect multi-stage privilege chains and skimmer exfiltration.

Administrators

Segregate sudo, NFS, cloud secrets, and CDN permissions, and monitor payment assets for tampering.

End Users

Since tampering is difficult for users to spot independently, regularly review credit card statements and promptly report suspicious transactions, and follow notifications from merchants.