# Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into 100+ E-Commerce Sites

> Gambit Security reconstructed a financially motivated, Chinese-speaking operator's campaign from an exposed staging server, showing open-source AI agents (Strix, Cairn, Hermes) used to breach online retailers at an average model cost of about $25 per target. Since July 2026 the operation has stolen more than 600,000 unexpired payment card records, planted Magecart-style web skimmers on 119+ sites, and in several cases destroyed victim database data after exfiltration.

- **Published:** 2026-09-23T00:00:00Z
- **Last reviewed:** 2026-09-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2633
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ai-agent-e-commerce-skimmers-tl-2026-2633.webp?v=e8671567 (Threadlinqs threat intel: Strix-Cairn-Hermes AI Skimmers: Detection & IOCs (TL-2026-2633) — Critical severity, 31 IOCs, 9 detection rules.)
- **ID:** TL-2026-2633
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)

## Description

Gambit Security published research on 2026-09-22 describing a payment-card theft campaign active since at least July 2026 and still ongoing at publication. The researchers obtained access to the attacker's exposed staging and command server (155.254.22.215), which hosted an AI operator console. From it they reconstructed an operation in which a single operator directed three open-source AI agent frameworks: Strix for vulnerability discovery, Cairn as an autonomous penetration-testing engine given a target and an objective (shell or admin access), and Hermes as the orchestration harness. Hermes carried a persistent 'SOUL - Red Team Operator' persona and 121 custom skills, 78 of them offensive. The operator typed 1,951 prompts across 260 sessions, mostly in Chinese, and accessed models through OpenRouter. Reporting names Anthropic Opus 4.6 plus DeepSeek and Kimi as the models used.

Scale and economics: between 2026-08-23 and 2026-08-31, Strix ran 146 deep-mode scans against 138 hosts, consuming 633 scanner-hours within 195 hours of clock time. Between 2026-09-10 and 2026-09-15, Gambit counted 105 attack projects. At least 27 named organizations were compromised to varying degrees and 19 skimmer infections were confirmed. Victims include a Fortune 500 hospitality company, a major U.S. airline, a U.S. industrial supplies distributor, and online retailers selling fashion, beauty, wine, bicycles, firearms, print-on-demand goods and photo printing, plus travel booking sites. More than 600,000 unexpired card records were stolen from two companies, about 79% of them belonging to U.S. cardholders. Beyond the direct targets, Gambit found 100+ other websites loading skimmer code from the same infrastructure. Model spend was about $7,005.71 over four weeks, with $12,000-$18,000 estimated in total. The mean was $25.46 per completed scan, ranging from $3.13 to $79.31 per target. Custom-coded shops were preferred over hosted platforms.

Intrusion and impact: reported initial access came through web application flaws such as SQL injection, chained to MFA bypass, admin access, web shells and database extraction. The attacker decrypted stored card numbers using stolen AWS Secrets Manager credentials. Skimmer persistence depended on the access level obtained. Methods included loader code appended to legitimate JavaScript libraries such as jQuery with the file timestamps restored, foreign script tags on checkout pages, loaders hidden inside Google Analytics / tag-manager blocks, S3 buckets behind CDNs poisoned using compromised AWS credentials, loaders appended to product descriptions in the database, Kubernetes deployments modified with an injected initContainer, poisoned server-side cached checkout pages, and a self-healing cron job in a JBoss log directory that re-injected the skimmer every two minutes. The injected loader follows the pattern new Function(atob('<7 junk chars><base64>'.slice(7)))(). Skimmer payloads were served from typosquatted CDN-lookalike domains (netlfjs, js-static, static-js, jsnetlify, netlifyjs, newssjs, x1opay, b8t.shop). Data was exfiltrated over DNS and HTTP listeners, with medbooksource.com used as the operator console and for out-of-band/DNS exfiltration. Attacks were routed through the IPRoyal, 711proxy and 1024proxy residential proxy services.

Destructive side effects: a Hermes skill titled 'Database Wipe After Extraction' told the agent to wipe payment-card source fields in Magento databases in batches once the data was downloaded. At one bicycle retailer, an overly broad cleanup routine dropped 180 database tables, including backups the administrators had created. Gambit coordinated takedowns with the Shadowserver Foundation and Cloudflare, but the operator repeatedly rebuilt the infrastructure. Defender priorities: hunt for the listed skimmer domains and URLs in page resources and CSP reports; look for integrity drift in first-party JS bundles, tag-manager containers, S3/CDN objects, database content fields, Kubernetes pod specs and cron tables; watch for high-entropy DNS to medbooksource.com; and plan for data-loss recovery, not just breach notification.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1583.001 Acquire Infrastructure: Domains
- T1190 Exploit Public-Facing Application
- T1505.003 Server Software Component: Web Shell
- T1053.003 Scheduled Task/Job: Cron
- T1610 Deploy Container
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores
- T1078.004 Valid Accounts: Cloud Accounts
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1070.006 Indicator Removal: Timestomp
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1056.003 Input Capture: Web Portal Capture
- T1213.006 Data from Information Repositories: Databases
- T1090.002 Proxy: External Proxy
- T1048.003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Secrets Manager Retrieval Followed by S3 Front-End JavaScript Overwrite by Same Access Key (CDN Skimmer Poisoning) — Post-Exploitation** (`TL-2026-2633-SPL-002`)

Detects the campaign's AWS pivot. The operator used stolen access keys to read AWS Secrets Manager (keys used to decrypt stored card numbers), then poisoned S3 buckets behind CDNs by overwriting JavaScript libraries and bundles with skimmer-loaded copies. The rule groups CloudTrail by access key and fires when the same key calls GetSecretValue/BatchGetSecretValue and later writes .js/.html objects to S3. Risk goes up when the key writes library-named assets (jquery, bundle, vendor, checkout, payment, gtm, analytics) or pulls several secrets.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1555.006, T1078.004, T1565.001, T1036.005
- **Data sources:** aws:cloudtrail (management + S3 data events), AWSCloudTrail (Microsoft Sentinel), aws cloudtrail
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=aws sourcetype=aws:cloudtrail earliest=-24h ((eventSource="secretsmanager.amazonaws.com" (eventName=GetSecretValue OR eventName=BatchGetSecretValue)) OR (eventSource="s3.amazonaws.com" (eventName=PutObject OR eventName=CopyObject OR eventName=CompleteMultipartUpload)))
| rename userIdentity.accessKeyId AS access_key, userIdentity.arn AS principal_arn, userIdentity.type AS identity_type, requestParameters.secretId AS secret_id, requestParameters.bucketName AS bucket, requestParameters.key AS object_key
| eval object_key=lower(object_key)
| eval secret_read=if(eventSource="secretsmanager.amazonaws.com", 1, 0)
| eval js_write=if(eventSource="s3.amazonaws.com" AND match(object_key, "\.(js|mjs|html?)$"), 1, 0)
| eval library_write=if(js_write=1 AND match(object_key, "(jquery|require|bundle|vendor|checkout|payment|gtm|analytics|main|app)[^/]*\.js$"), 1, 0)
| where secret_read=1 OR js_write=1
| stats min(eval(if(secret_read=1, _time, null()))) AS first_secret_read min(eval(if(js_write=1, _time, null()))) AS first_js_write sum(secret_read) AS secret_reads dc(secret_id) AS distinct_secrets sum(js_write) AS js_writes sum(library_write) AS library_writes values(bucket) AS buckets values(object_key) AS objects values(sourceIPAddress) AS src_ips values(userAgent) AS user_agents BY access_key principal_arn identity_type
``` same key: read secrets, then overwrite front-end JS ```
| where secret_reads>=1 AND js_writes>=1 AND first_js_write>=first_secret_read
| eval risk=case(library_writes>=1 AND distinct_secrets>=2, "critical", library_writes>=1, "high", true(), "medium")
| convert ctime(first_secret_read) ctime(first_js_write)
| sort - library_writes
````

### Microsoft KQL

```kql
let lookback = 24h;
let SecretReads = AWSCloudTrail
| where TimeGenerated > ago(lookback)
| where EventSource == 'secretsmanager.amazonaws.com' and EventName in ('GetSecretValue', 'BatchGetSecretValue')
| extend SecretId = tostring(parse_json(RequestParameters).secretId)
| summarize SecretReadCount = count(), Secrets = make_set(SecretId, 20), FirstSecretRead = min(TimeGenerated), SecretSrcIps = make_set(SourceIpAddress, 10) by UserIdentityAccessKeyId, UserIdentityArn;
let JsWrites = AWSCloudTrail
| where TimeGenerated > ago(lookback)
| where EventSource == 's3.amazonaws.com' and EventName in ('PutObject', 'CopyObject', 'CompleteMultipartUpload')
| extend Bucket = tostring(parse_json(RequestParameters).bucketName), ObjectKey = tolower(tostring(parse_json(RequestParameters).key))
| where ObjectKey matches regex @'\.(js|mjs|html?)$'
| extend LibraryAsset = ObjectKey matches regex @'(jquery|require|bundle|vendor|checkout|payment|gtm|analytics|main|app)[^/]*\.js$'
| summarize JsWriteCount = count(), LibraryWrites = countif(LibraryAsset), Objects = make_set(ObjectKey, 25), Buckets = make_set(Bucket, 10), FirstJsWrite = min(TimeGenerated), WriteSrcIps = make_set(SourceIpAddress, 10), UserAgents = make_set(UserAgent, 5) by UserIdentityAccessKeyId;
SecretReads
| join kind=inner JsWrites on UserIdentityAccessKeyId
| where FirstJsWrite >= FirstSecretRead
| extend Risk = case(LibraryWrites >= 1 and array_length(Secrets) >= 2, 'critical', LibraryWrites >= 1, 'high', 'medium')
| project FirstSecretRead, FirstJsWrite, UserIdentityAccessKeyId, UserIdentityArn, Risk, SecretReadCount, Secrets, JsWriteCount, LibraryWrites, Buckets, Objects, SecretSrcIps, WriteSrcIps, UserAgents
| order by LibraryWrites desc
```

### Sigma

```yaml
title: Front-End JavaScript Object Overwritten in S3 by Non-Pipeline Principal (CDN Skimmer Poisoning)
id: 2d8f6a4c-1b3e-4c57-9d92-7e8f9a0b1c24
status: experimental
description: Detects PutObject/CopyObject/CompleteMultipartUpload of JavaScript library, bundle, tag-manager or checkout assets in S3 by a principal other than the CI/CD pipeline. The AI-agent Magecart operator used this S3/CDN poisoning technique with AWS keys stolen from Secrets Manager. For high-fidelity alerting, correlate with GetSecretValue/BatchGetSecretValue by the same userIdentity.accessKeyId (see the SPL/KQL flavors). Requires S3 data-event logging.
references:
  - https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company
  - https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/
author: Threadlinqs Team
date: 2026-09-23
tags:
  - attack.impact
  - attack.t1565.001
  - attack.defense-evasion
  - attack.t1078.004
  - attack.t1036.005
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_write:
    eventSource: s3.amazonaws.com
    eventName:
      - PutObject
      - CopyObject
      - CompleteMultipartUpload
    requestParameters.key|endswith: '.js'
  selection_asset:
    requestParameters.key|contains:
      - 'jquery'
      - 'require'
      - 'bundle'
      - 'vendor'
      - 'checkout'
      - 'payment'
      - 'gtm'
      - 'analytics'
  filter_pipeline_agent:
    userAgent|contains:
      - 'codebuild.amazonaws.com'
      - 'codepipeline.amazonaws.com'
      - 'cloudformation.amazonaws.com'
  filter_pipeline_role:
    userIdentity.arn|contains:
      - 'deploy'
      - 'cicd'
      - 'github-actions'
  condition: selection_write and selection_asset and not 1 of filter_pipeline_*
falsepositives:
  - Front-end releases pushed by developers or pipelines whose role names do not match the filter
  - Tag-manager or analytics vendors granted write access to a shared asset bucket
level: high
```

**Known false positives:**

- CI/CD deploy roles that fetch a secret (e.g. an npm or CDN token) and then publish the front-end bundle
- Developers manually hot-fixing a JS asset with credentials that also read Secrets Manager
- Backup or replication jobs copying static assets between buckets

**Tuning notes:** Enable CloudTrail S3 data events (write-only is enough) on every bucket behind CloudFront or other CDNs; without them the S3 half never fires. Replace the placeholder 'deploy'/'cicd'/'github-actions' role filters with your real pipeline role ARNs. Raise to critical when sourceIPAddress is outside AWS/corporate ranges or is a residential proxy, and when the key belongs to an application IAM user (identity_type=IAMUser) rather than an assumed role. Pair each hit with an integrity diff of the written object against source control.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Web Shell Dropped by Storefront Web Process Followed by Shell/DB-Dump Execution — Exploitation (locked: unlock with TL Creds)
- Kubernetes Workload Patched with Injected initContainer Carrying Skimmer-Injection Logic — Post-Exploitation (locked: unlock with TL Creds)
- Magento Payment-Card Field Wipe, Mass DROP TABLE or Skimmer Loader Written to Database Content — Impact / Exfiltration Aftermath (locked: unlock with TL Creds)
- Web Shell Request to Server-Side Script in Storefront Upload/Media/Static Directory — Exploitation (locked: unlock with TL Creds)
- Skimmer Re-Injection Persistence: Cron Job in JBoss Log Directory, JS Timestomping or Inline atob Loader — Post-Exploitation (locked: unlock with TL Creds)
- Fetch of AI-Agent Magecart Skimmer Script From Typosquatted CDN-Lookalike Domain — C2 / Skimmer Delivery (locked: unlock with TL Creds)
- AI-Agent-Paced Vulnerability Scanning and SQL Injection Against E-Commerce Storefront (Strix/Cairn) — Exploitation (locked: unlock with TL Creds)
- DNS Exfiltration to [indicator] and Contact With AI-Agent Magecart C2/Skimmer Infrastructure — C2 / Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- IP address: `155.254.22[.]215`
- Domain: `medbooksource[.]com`
- IP address: `209.126.4[.]170`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Gambit Security - Autonomous AI agents attacking online retailers (~$25 a company)](https://gambit.security/blog-posts/autonomous-ai-agents-online-retailers-25-a-company)
- [Malicious AI agents steal 600K credit cards, infect 100-plus sites with skimmers](https://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/)
- [Autonomous AI Agents Hack Retailers for $25 and Steal 600,000 Credit Cards](https://cybersecuritynews.com/ai-agents-retail-credit-card-theft/)
- [Open-Source AI Agents Breach 27 Companies, Steal 600,000 Credit Card Records](https://hackread.com/open-source-ai-agents-breach-credit-card-records/)
- [AI agents steal 600,000 credit cards in attacks on online retailers](https://cyberinsider.com/ai-agents-steal-600000-credit-cards-in-attacks-on-online-retailers/)
- [Chinese-speaking hacker used AI agents to steal 600,000 credit cards](https://qz.com/chinese-hacker-ai-agents-credit-card-breach-100-companies-092226)
- [Autonomous AI Agents Hack Online Retailers for $25 a Target, Steal 600,000 Credit Cards](https://cyberpress.org/autonomous-ai-agents-hack-online-retailers-for-25-a-target-steal-600000-credit-cards/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2633