A financially motivated threat actor has been using three open-source AI harnesses (tools that coordinate and run AI tasks autonomously) to conduct low-cost, automated attacks against companies, particularly online retailers.
In its research shared with Hackread.com, Gambit Security researchers recovered an exposed staging server that revealed an ongoing campaign running since July 2026.
The attacker’s own review calculated an average cost of $25.46 across 101 completed scans, ranging from $3.13 to $79.31 per target, with the tools used to steal payment details and compromise web applications.
Between September 10 and 15, the operator initiated 105 attack projects and compromised at least 27 companies to varying degrees. Identified targets included an online fashion retailer, a Fortune 500 hospitality company, a major US airline, and a large US industrial supplies distributor.
Multi-Stage Exploitation Pipeline
The operation relied on three open-source AI harnesses working together with minimal manual input, including Strix, Cairn, and Hermes.
- Strix, an open-source, AI-powered penetration-testing tool, was used for vulnerability discovery and ran 146 times in “deep mode” against 138 hosts, accounting for 633 hours of scanner time within 195 hours of actual elapsed time.
- Cairn, an autonomous penetration testing engine, received target domains and objectives such as obtaining shell or administrative access, then conducted probes and exploitation attempts until it succeeded, timed out, or was stopped.
- Hermes served as the central orchestration harness, with persistent memory, a searchable archive, and custom skills. It loaded a Chinese persona called “SOUL – Red Team Operator” and 78 attack-related skills. The operator also added a skill intended to remove Hermes’ content-security filters.
According to Gamnit Security’s blog post, human input remained sparse. Across 260 Hermes sessions, the operator typed 1,951 short commands in Chinese, often telling the agent to review a vulnerability report, test access, investigate an API or continue after gaining access.
In one documented attack chain, the agent used an SQL injection to obtain a plaintext one-time password, access a web panel, upload a web shell, escalate privileges through a misconfigured sudo rule, and access AWS credentials.
Researchers said the low cost and speed of the attacks were particularly impactful. Each target cost only tens of dollars, while successful intrusions usually took less than one day and sometimes only a few hours, creating what they described as “a remediation clock most organizations cannot hold.”
Data Theft and System Destruction
The campaign resulted in more than 600,000 unexpired credit card records being exfiltrated from two companies. The operator ordered skimmer deployments against at least 27 named victims, with malicious scripts confirmed on 19 websites. Researchers also identified more than 100 additional sites infected with skimmers associated with the campaign.
These skimmers were deployed in several ways, including by appending malicious code to legitimate JavaScript libraries, placing scripts in checkout pages, poisoning AWS S3 content, and modifying database content.
At one US wine retailer, a cron job checked the affected file every two minutes and restored the malicious code after the application redeployed a clean version.
This activity also caused data loss. A Hermes skill titled “Database Wipe After Extraction” instructed the agent to clear payment data from Magento databases after card information was downloaded. At a bicycle retailer, an automated cleanup routine dropped 180 tables matching specific prefixes, including backup tables created by the victim’s administrators.
Gambit Security worked with the Shadowserver Foundation and other industry partners to notify affected organisations and take down infrastructure linked to the campaign. The campaign shows that open-source AI agents can now perform reconnaissance, exploitation, persistence, payment-data theft, and destructive cleanup with limited human direction.
