Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into 100+ E-Commerce Sites

Key facts

Detection coverage

As of 2026-09-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2633 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Secrets Manager Retrieval Followed by S3 Front-End JavaScript Overwrite by Same Access Key (CDN Skimmer Poisoning) — Post-Exploitation

Detects the campaign's AWS pivot. The operator used stolen access keys to read AWS Secrets Manager (keys used to decrypt stored card numbers), then poisoned S3 buckets behind CDNs by overwriting JavaScript libraries and bundles with skimmer-loaded copies. The rule groups CloudTrail by access key and fires when the same key calls GetSecretValue/BatchGetSecretValue and later writes .js/.html objects to S3. Risk goes up when the key writes library-named assets (jquery, bundle, vendor, checkout, payment, gtm, analytics) or pulls several secrets.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.006, T1078.004, T1565.001, T1036.005
• Data sources: aws:cloudtrail (management + S3 data events), AWSCloudTrail (Microsoft Sentinel), aws cloudtrail
• Severity: critical
• Confidence: high

Splunk SPL

index=aws sourcetype=aws:cloudtrail earliest=-24h ((eventSource="secretsmanager.amazonaws.com" (eventName=GetSecretValue OR eventName=BatchGetSecretValue)) OR (eventSource="s3.amazonaws.com" (eventName=PutObject OR eventName=CopyObject OR eventName=CompleteMultipartUpload)))
| rename userIdentity.accessKeyId AS access_key, userIdentity.arn AS principal_arn, userIdentity.type AS identity_type, requestParameters.secretId AS secret_id, requestParameters.bucketName AS bucket, requestParameters.key AS object_key
| eval object_key=lower(object_key)
| eval secret_read=if(eventSource="secretsmanager.amazonaws.com", 1, 0)
| eval js_write=if(eventSource="s3.amazonaws.com" AND match(object_key, "\.(js|mjs|html?)$"), 1, 0)
| eval library_write=if(js_write=1 AND match(object_key, "(jquery|require|bundle|vendor|checkout|payment|gtm|analytics|main|app)[^/]*\.js$"), 1, 0)
| where secret_read=1 OR js_write=1
| stats min(eval(if(secret_read=1, _time, null()))) AS first_secret_read min(eval(if(js_write=1, _time, null()))) AS first_js_write sum(secret_read) AS secret_reads dc(secret_id) AS distinct_secrets sum(js_write) AS js_writes sum(library_write) AS library_writes values(bucket) AS buckets values(object_key) AS objects values(sourceIPAddress) AS src_ips values(userAgent) AS user_agents BY access_key principal_arn identity_type
``` same key: read secrets, then overwrite front-end JS ```
| where secret_reads>=1 AND js_writes>=1 AND first_js_write>=first_secret_read
| eval risk=case(library_writes>=1 AND distinct_secrets>=2, "critical", library_writes>=1, "high", true(), "medium")
| convert ctime(first_secret_read) ctime(first_js_write)
| sort - library_writes

Microsoft KQL

let lookback = 24h;
let SecretReads = AWSCloudTrail
| where TimeGenerated > ago(lookback)
| where EventSource == 'secretsmanager.amazonaws.com' and EventName in ('GetSecretValue', 'BatchGetSecretValue')
| extend SecretId = tostring(parse_json(RequestParameters).secretId)
| summarize SecretReadCount = count(), Secrets = make_set(SecretId, 20), FirstSecretRead = min(TimeGenerated), SecretSrcIps = make_set(SourceIpAddress, 10) by UserIdentityAccessKeyId, UserIdentityArn;
let JsWrites = AWSCloudTrail
| where TimeGenerated > ago(lookback)
| where EventSource == 's3.amazonaws.com' and EventName in ('PutObject', 'CopyObject', 'CompleteMultipartUpload')
| extend Bucket = tostring(parse_json(RequestParameters).bucketName), ObjectKey = tolower(tostring(parse_json(RequestParameters).key))
| where ObjectKey matches regex @'\.(js|mjs|html?)$'
| extend LibraryAsset = ObjectKey matches regex @'(jquery|require|bundle|vendor|checkout|payment|gtm|analytics|main|app)[^/]*\.js$'
| summarize JsWriteCount = count(), LibraryWrites = countif(LibraryAsset), Objects = make_set(ObjectKey, 25), Buckets = make_set(Bucket, 10), FirstJsWrite = min(TimeGenerated), WriteSrcIps = make_set(SourceIpAddress, 10), UserAgents = make_set(UserAgent, 5) by UserIdentityAccessKeyId;
SecretReads
| join kind=inner JsWrites on UserIdentityAccessKeyId
| where FirstJsWrite >= FirstSecretRead
| extend Risk = case(LibraryWrites >= 1 and array_length(Secrets) >= 2, 'critical', LibraryWrites >= 1, 'high', 'medium')
| project FirstSecretRead, FirstJsWrite, UserIdentityAccessKeyId, UserIdentityArn, Risk, SecretReadCount, Secrets, JsWriteCount, LibraryWrites, Buckets, Objects, SecretSrcIps, WriteSrcIps, UserAgents
| order by LibraryWrites desc

Sigma

title: Front-End JavaScript Object Overwritten in S3 by Non-Pipeline Principal (CDN Skimmer Poisoning)
id: 2d8f6a4c-1b3e-4c57-9d92-7e8f9a0b1c24
status: experimental
description: Detects PutObject/CopyObject/CompleteMultipartUpload of JavaScript library, bundle, tag-manager or checkout assets in S3 by a principal other than the CI/CD pipeline. The AI-agent Magecart operator used this S3/CDN poisoning technique with AWS keys stolen from Secrets Manager. For high-fidelity alerting, correlate with GetSecretValue/BatchGetSecretValue by the same userIdentity.accessKeyId (see the SPL/KQL flavors). Requires S3 data-event logging.
references:
  - https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company
  - https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/
author: Threadlinqs Team
date: 2026-09-23
tags:
  - attack.impact
  - attack.t1565.001
  - attack.defense-evasion
  - attack.t1078.004
  - attack.t1036.005
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_write:
    eventSource: s3.amazonaws.com
    eventName:
      - PutObject
      - CopyObject
      - CompleteMultipartUpload
    requestParameters.key|endswith: '.js'
  selection_asset:
    requestParameters.key|contains:
      - 'jquery'
      - 'require'
      - 'bundle'
      - 'vendor'
      - 'checkout'
      - 'payment'
      - 'gtm'
      - 'analytics'
  filter_pipeline_agent:
    userAgent|contains:
      - 'codebuild.amazonaws.com'
      - 'codepipeline.amazonaws.com'
      - 'cloudformation.amazonaws.com'
  filter_pipeline_role:
    userIdentity.arn|contains:
      - 'deploy'
      - 'cicd'
      - 'github-actions'
  condition: selection_write and selection_asset and not 1 of filter_pipeline_*
falsepositives:
  - Front-end releases pushed by developers or pipelines whose role names do not match the filter
  - Tag-manager or analytics vendors granted write access to a shared asset bucket
level: high

Known false positives:

• CI/CD deploy roles that fetch a secret (e.g. an npm or CDN token) and then publish the front-end bundle
• Developers manually hot-fixing a JS asset with credentials that also read Secrets Manager
• Backup or replication jobs copying static assets between buckets

Tuning notes: Enable CloudTrail S3 data events (write-only is enough) on every bucket behind CloudFront or other CDNs; without them the S3 half never fires. Replace the placeholder 'deploy'/'cicd'/'github-actions' role filters with your real pipeline role ARNs. Raise to critical when sourceIPAddress is outside AWS/corporate ranges or is a residential proxy, and when the key belongs to an application IAM user (identity_type=IAMUser) rather than an assumed role. Pair each hit with an integrity diff of the written object against source control.

• 🔒 Web Shell Dropped by Storefront Web Process Followed by Shell/DB-Dump Execution — Exploitation · unlock with TL Creds
• 🔒 Kubernetes Workload Patched with Injected initContainer Carrying Skimmer-Injection Logic — Post-Exploitation · unlock with TL Creds
• 🔒 Magento Payment-Card Field Wipe, Mass DROP TABLE or Skimmer Loader Written to Database Content — Impact / Exfiltration Aftermath · unlock with TL Creds
• 🔒 Web Shell Request to Server-Side Script in Storefront Upload/Media/Static Directory — Exploitation · unlock with TL Creds
• 🔒 Skimmer Re-Injection Persistence: Cron Job in JBoss Log Directory, JS Timestomping or Inline atob Loader — Post-Exploitation · unlock with TL Creds
• 🔒 Fetch of AI-Agent Magecart Skimmer Script From Typosquatted CDN-Lookalike Domain — C2 / Skimmer Delivery · unlock with TL Creds
• 🔒 AI-Agent-Paced Vulnerability Scanning and SQL Injection Against E-Commerce Storefront (Strix/Cairn) — Exploitation · unlock with TL Creds
• 🔒 DNS Exfiltration to [indicator] and Contact With AI-Agent Magecart C2/Skimmer Infrastructure — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-09-23, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-2633.

Sample indicators (3 of 31)

• IP address: 155.254.22[.]215
• Domain: medbooksource[.]com
• IP address: 209.126.4[.]170

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

Technical analysis

Gambit Security published research on 2026-09-22 describing a payment-card theft campaign active since at least July 2026 and still ongoing at publication. The researchers obtained access to the attacker's exposed staging and command server (155.254.22.215), which hosted an AI operator console. From it they reconstructed an operation in which a single operator directed three open-source AI agent frameworks: Strix for vulnerability discovery, Cairn as an autonomous penetration-testing engine given a target and an objective (shell or admin access), and Hermes as the orchestration harness. Hermes carried a persistent 'SOUL - Red Team Operator' persona and 121 custom skills, 78 of them offensive. The operator typed 1,951 prompts across 260 sessions, mostly in Chinese, and accessed models through OpenRouter. Reporting names Anthropic Opus 4.6 plus DeepSeek and Kimi as the models used.

Scale and economics: between 2026-08-23 and 2026-08-31, Strix ran 146 deep-mode scans against 138 hosts, consuming 633 scanner-hours within 195 hours of clock time. Between 2026-09-10 and 2026-09-15, Gambit counted 105 attack projects. At least 27 named organizations were compromised to varying degrees and 19 skimmer infections were confirmed. Victims include a Fortune 500 hospitality company, a major U.S. airline, a U.S. industrial supplies distributor, and online retailers selling fashion, beauty, wine, bicycles, firearms, print-on-demand goods and photo printing, plus travel booking sites. More than 600,000 unexpired card records were stolen from two companies, about 79% of them belonging to U.S. cardholders. Beyond the direct targets, Gambit found 100+ other websites loading skimmer code from the same infrastructure. Model spend was about $7,005.71 over four weeks, with $12,000-$18,000 estimated in total. The mean was $25.46 per completed scan, ranging from $3.13 to $79.31 per target. Custom-coded shops were preferred over hosted platforms.

Intrusion and impact: reported initial access came through web application flaws such as SQL injection, chained to MFA bypass, admin access, web shells and database extraction. The attacker decrypted stored card numbers using stolen AWS Secrets Manager credentials. Skimmer persistence depended on the access level obtained. Methods included loader code appended to legitimate JavaScript libraries such as jQuery with the file timestamps restored, foreign script tags on checkout pages, loaders hidden inside Google Analytics / tag-manager blocks, S3 buckets behind CDNs poisoned using compromised AWS credentials, loaders appended to product descriptions in the database, Kubernetes deployments modified with an injected initContainer, poisoned server-side cached checkout pages, and a self-healing cron job in a JBoss log directory that re-injected the skimmer every two minutes. The injected loader follows the pattern new Function(atob('<7 junk chars><base64>'.slice(7)))(). Skimmer payloads were served from typosquatted CDN-lookalike domains (netlfjs, js-static, static-js, jsnetlify, netlifyjs, newssjs, x1opay, b8t.shop). Data was exfiltrated over DNS and HTTP listeners, with medbooksource.com used as the operator console and for out-of-band/DNS exfiltration. Attacks were routed through the IPRoyal, 711proxy and 1024proxy residential proxy services.

Destructive side effects: a Hermes skill titled 'Database Wipe After Extraction' told the agent to wipe payment-card source fields in Magento databases in batches once the data was downloaded. At one bicycle retailer, an overly broad cleanup routine dropped 180 database tables, including backups the administrators had created. Gambit coordinated takedowns with the Shadowserver Foundation and Cloudflare, but the operator repeatedly rebuilt the infrastructure. Defender priorities: hunt for the listed skimmer domains and URLs in page resources and CSP reports; look for integrity drift in first-party JS bundles, tag-manager containers, S3/CDN objects, database content fields, Kubernetes pod specs and cron tables; watch for high-entropy DNS to medbooksource.com; and plan for data-loss recovery, not just breach notification.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.006 Indicator Removal: Timestomp; T1078.004 Valid Accounts: Cloud Accounts

Exfiltration

T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Persistence

T1053.003 Scheduled Task/Job: Cron; T1505.003 Server Software Component: Web Shell

Collection

T1056.003 Input Capture: Web Portal Capture; T1213.006 Data from Information Repositories: Databases

Execution

T1059.007 Command and Scripting Interpreter: JavaScript; T1610 Deploy Container

Command and Control

T1090.002 Proxy: External Proxy

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1565.001 Data Manipulation: Stored Data Manipulation

Credential Access

T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation

Patches

• No CVE was attributed. Patch and fix SQL injection and authentication flaws in custom e-commerce code and keep Magento/Adobe Commerce and JBoss deployments on supported, patched releases

Immediate actions

• Block and hunt for the published skimmer domains, URLs and C2 IPs (medbooksource.com, traffic-analyzer.net, b8t.shop, netlfjs/js-static/static-js/jsnetlify/netlifyjs/newssjs/x1opay domains, 155.254.22.215, 209.126.4.170, 213.21.239.62, 172.245.224.188, 172.245.89.137) in DNS, proxy and CSP report logs
• Search first-party JavaScript bundles, HTML templates, tag-manager/Google Analytics blocks, database content fields (e.g. product descriptions) and cached checkout pages for the loader pattern new Function(atob('...'.slice(7)))()
• Diff S3/CDN-hosted static assets against source control and review CloudTrail for PutObject by unexpected principals
• Inspect Kubernetes deployments for unexpected initContainers and review crontabs, including JBoss log directories, for re-injection jobs
• Rotate AWS access keys and Secrets Manager secrets, admin panel credentials and database credentials on any affected host
• Coordinate with card brands/acquirers for compromised-card notification (PCI DSS incident response)

Workarounds

• Place a WAF in front of custom storefronts to block SQL injection and web-shell upload attempts
• Restrict admin panels to VPN/allow-listed networks and require phishing-resistant MFA
• Apply least-privilege IAM to S3 buckets serving front-end assets (no write access from application credentials)

Longer-term hardening

• Enforce a strict Content-Security-Policy and Subresource Integrity on checkout pages and monitor CSP violation reports (PCI DSS 4.0 req. 6.4.3 and 11.6.1 payment-page script and change monitoring)
• Deploy file-integrity monitoring on web roots and static asset buckets, with timestamp-independent hashing (the attacker restored mtimes)
• Tokenize or externalize card storage so that stored PANs and decryption keys are not reachable from the web tier
• Keep offline, immutable database backups: attacker cleanup routines destroyed both data and admin-created backups
• Tune detection and response for AI-paced intrusions that complete in hours, e.g. alert on sustained high-volume scanning from residential proxy ranges
• Adopt a resilience-first recovery plan that covers business continuity, not only data restoration

Affected and fixed versions

• Custom-coded — E-commerce storefronts and checkout pages
  Vulnerable versions: custom applications with SQL injection / authentication flaws
• Adobe — Magento / Adobe Commerce
  Vulnerable versions: deployments compromised via admin access (card fields wiped after exfiltration)
• Amazon Web Services — S3 / CloudFront-hosted static assets and Secrets Manager
  Vulnerable versions: accounts with compromised access keys
• Red Hat — JBoss application server hosts
  Vulnerable versions: hosts where cron persistence was planted
• Kubernetes — E-commerce workloads (Deployments)
  Vulnerable versions: deployments modified with a malicious initContainer

Timeline

• 2026-07-01 Campaign activity begins (reported as 'since at least July 2026'); tens of companies were targeted by AI-agent-driven intrusions
• 2026-08-23 Strix deep-mode scanning wave begins: 146 scans against 138 hosts through 2026-08-31 (633 scanner-hours in 195 clock-hours)
• 2026-08-31 End of the peak Strix vulnerability-scanning window documented by Gambit
• 2026-09-10 Start of the peak exploitation window: 105 attack projects launched through 2026-09-15
• 2026-09-15 Peak window ends with at least 27 organizations compromised, including a Fortune 500 hospitality company, a major U.S. airline and a U.S. industrial supplies distributor
• 2026-09-22 Gambit Security publishes its analysis of the exposed staging server, including IOCs; takedowns coordinated with Shadowserver and Cloudflare, while the operator rebuilds and the campaign continues
• 2026-09-23 BleepingComputer, HackRead and other outlets report the 600K+ card theft and 100+ skimmer-infected sites

Sources cited

• Gambit Security - Autonomous AI agents attacking online retailers (~$25 a company) gambit.security · Research · 2026-09-22
• Malicious AI agents steal 600K credit cards, infect 100-plus sites with skimmers BleepingComputer · News · 2026-09-23
• Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards cybersecuritynews.com · News · 2026-09-22
• Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card Records hackread.com · News · 2026-09-23
• AI agents steal 600,000 credit cards in attacks on online retailers cyberinsider.com · News · 2026-09-23
• Chinese-speaking hacker used AI agents to steal 600,000 credit cards qz.com · News · 2026-09-22
• Autonomous AI Agents Hack Online Retailers for $25 a Target, Steal 600,000 Credit Cards cyberpress.org · News · 2026-09-23

More in malware

• Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013)
• Mirax Android Banking RAT Abuses Accessibility Services for Device Takeover and Bank Fraud in the Middle East, Türkiye and Africa
• RemControl: Android banking trojan MaaS abusing Accessibility Service, AI-assisted phishing overlays (affiliate UNKK)
• Exvicy: ClickFix MaaS Framework Copycat of ErrTraffic Distributing Malware via Compromised WordPress Sites
• Blind Eagle (APT-C-36) Uses Fake Court Notices to Deliver AsyncRAT/DCRat-Lineage RAT Across Latin America

Previous and next in malware

• RemControl Android Banking Trojan Targets Italy and France via Fake TVTap IPTV App Previous report
• MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar (SONOMAC1) Next report