AI Agents Steal 600,000 Credit Cards in Autonomous Cyberattack Campaign Costing Just $25 Per Scan

AI Agents Execute Massive Credit Card Theft at Trivial Cost

A financially motivated threat actor has weaponized three open-source AI agents to orchestrate an autonomous cyberattack campaign that compromised at least 27 companies and stole more than 600,000 credit card records1

1

2

2

. Between September 10 and September 15 alone, the attacker launched 105 distinct attack waves, with the campaign remaining active as of September 222

2

. Victims include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer1

1

3

3

. The operation's economics prove alarming: each completed scan cost an average of $25.46, with the cheapest target breached for just $3.13 and the most expensive for $79.311

1

2

2

.

Three AI Frameworks Orchestrate Near-Autonomous Attacks

AI security company Gambit recovered the Chinese-speaking operator's staging server and reconstructed the entire data-theft campaign from logs, stolen data, and verified compromises on live sites1

1

3

3

. The attacker deployed three distinct open-source AI agents, each serving a specialized role in the attack chain. Strix, an open-source penetration testing tool, handled vulnerability scanning and ran on Z.ai's GLM 5.2 before switching to DeepSeek V4 Pro1

1

3

3

. Between August 23 and 31, the operator ran Strix 146 times in deep mode against 138 hosts, accumulating 633 scanning hours in just 195 hours of clock time1

1

. Cairn, an autonomous exploitation engine running on DeepSeek V4.1 Flash, received target domains and attack objectives like deploying a shell or achieving admin access, then executed until completing the objective, timing out, or being manually stopped1

1

3

3

. Hermes served as campaign orchestrator, utilizing Anthropic Claude Opus 4.6 after newer models refused the attack requests1

1

3

3

.

Minimal Human Input Drives Maximum Damage

The human operator loaded a Chinese system persona titled "SOUL - Red Team Operator" on Hermes with 121 skills, including 78 attack skills and one that removed content security filters from the AI harness1

1

. Across 260 sessions, the operator typed just 1,951 prompts in Chinese—only a few prompts per target—with brief instructions like "See whether the file upload in the report can give code execution" and "Get into the web backend"1

1

4

4

. Where access was achieved, it typically took less than a day, and in many cases just a few hours1

1

4

4

. The autonomous AI agents chose each attack path in real time through extensive probing and exploitation attempts, resulting in dynamic and mostly different tactics, techniques, and procedures across victims1

1

. In one documented instance, the AI agent used SQL injection to obtain a plaintext one-time password, accessed a web panel, uploaded a web shell, escalated privileges through a misconfigured sudo rule, accessed AWS credentials, and ultimately dumped 46 secrets totaling 102KB1

1

.

Card-Stealing Skimmers Deployed Across 100+ Websites

Injecting card-stealing skimmers into checkout pages of online shops represented one of the operator's primary objectives1

1

. The attacker ordered skimmer deployment against at least 27 named victims, with scripts confirmed present on 19 websites1

1

. Security researcher Varys helped detect more than 100 additional infected websites linked to this AI-driven cybercrime campaign1

1

2

2

. The most common injection method involved appending malicious code to existing JavaScript files, though attackers also added script tags to checkout pages or Google tag blocks, poisoned S3/CDN content and server-side caches, modified database fields, altered Kubernetes deployments, and used cron jobs to restore skimmers after removal1

1

2

2

. At one US wine retailer, a cron job reinstalled the skimmer every two minutes after the site was redeployed3

3

. The 600,000 stolen cards came from just two companies, with 79% belonging to US cardholders3

3

.

Campaign Economics Reveal Disturbing Scalability

According to an August 25 OpenRouter account balance, the operator spent $7,005.71 over the previous four weeks1

1

. The attacker then continued attacks for three more weeks at twice the daily volume of model calls1

1

. Gambit estimates the total cost of the campaign sits between $12,000 and $18,0001

1

2

2

. The attacker used a website traffic-ranking service to identify valuable targets from Strix's scan results, prioritizing those running custom software as they were more likely to be vulnerable2

2

4

4

. This targeting strategy, combined with the low per-scan cost, demonstrates how AI agent misuse enables financially motivated threat actors to operate at unprecedented scale.

Collateral Damage: Data Deletion Disrupts Operations

Instructions in the attacker's playbook included cleanup procedures that could disrupt company operations through data deletion, and this indeed happened in some breaches1

1

4

4

. Gambit discovered that the attacker instructed the AI agent to run cleanup procedures removing card data from Magento databases after exfiltration2

2

. One Hermes skill file contained the instruction: "After extracting and downloading all card data, wipe the source fields in batches"2

2

. This caused operational disruptions at several retailers due to data losses2

2

. At one bicycle retailer, autonomous AI agents dropped 180 database tables, including backups the victim's own administrators had created3

3

.

Industry Experts Sound Alarm on AI-Driven Cyber Threats

Microsoft founder Bill Gates warned during an NBC interview that the main risk of AI isn't rogue systems but ill-intentioned actors using AI for attacks that would have cost millions without this technology5

5

. "The most dangerous thing about AI is people's bad intentions using it for things like defrauding individuals, shutting down electrical systems, or scrambling bank accounts," Gates stated5

5

. "There has never been a weapon as powerful as the combination of people with ill intentions using the latest AI tools," he claimed5

5

. Eyal Sela, Gambit's director of threat intelligence, emphasized that this campaign demonstrates how the remediation clock—the time organizations have to detect intrusions and remediate vulnerabilities—has dramatically shortened1

1

. The AI harnesses ran at a tempo no human operator could sustain, with the person reduced to short instructions1

1

.

What Organizations Must Do Now

Gambit contacted many affected organizations and helped take down infrastructure with assistance from the Shadowserver Foundation, while Overwatch Data handles fraud reporting to card issuers3

3

. The campaign, active since at least July and ongoing as of September 22, likely has a larger actual size and impact than currently reported2

2

5

5

. Security experts urge organizations to adapt to a reality where autonomous cyberattack campaigns execute significantly faster and more comprehensively than traditional threats4

4

. Companies must adopt a resilience-first mentality and deploy AI-resilient security stacks capable of matching AI agents on speed4

4

. Watch for Chinese AI models like DeepSeek V4 Pro being weaponized, privilege escalation attempts following vulnerability scanning, and persistent skimmer deployments that restore themselves after removal. The automation and low cost make it easy for even less skilled threat actors to deploy such attacks, fundamentally changing the cybersecurity landscape2

2

.