As reported by BleepingComputer, researchers at Gambit have uncovered a financially motivated campaign that represents a watershed moment in offensive AI usage. A threat actor—believed to be Chinese—deployed three open-source AI agent frameworks to autonomously scan, exploit, and inject web skimmers into e-commerce infrastructure at a pace no human operator could match individually.
What makes this campaign significant is not merely the volume—600,000+ stolen card records and 119 compromised sites—but the degree of autonomy demonstrated. The operator issued high-level objectives, and the AI agent stack (Strix for recon, Cairn for exploitation, Hermes for orchestration) executed the full kill chain: discovery, compromise, skimmer deployment, and persistence. Hermes reportedly operated using a "Red Team Operator" persona with 121 skills loaded, 78 of which were attack-related.
Why This Matters
This campaign validates what defenders have feared since AI agent frameworks began proliferating: the barrier to conducting complex, multi-stage attacks at scale has collapsed. A single operator with brief instructions can now project force across hundreds of targets simultaneously. The traditional defender advantage—attackers being resource-constrained and requiring manual effort—erodes when AI agents compress what would take weeks of human labor into days.
The persistence techniques observed are equally concerning. The agents demonstrated awareness of target architecture, deploying skimmers through JavaScript file modification, checkout page injection, S3/CDN poisoning, Kubernetes deployment alteration, and self-healing cron jobs. This isn't script-kiddie behavior; it's adaptive, context-aware compromise.
Who Is Affected
Reported victims include a Fortune 500 hospitality company, a major U.S. airline, a large industrial supplies distributor, and an online fashion retailer. However, the targeting methodology—using traffic-ranking services to identify high-volume e-commerce sites—means any organization processing online payments is potentially exposed. The 119 confirmed compromises likely represent a fraction of actual impact.
Broader Implications
The offensive AI agent ecosystem is maturing faster than defensive AI adoption. Frameworks designed for penetration testing and red teaming are being repurposed with minimal modification, and the open-source availability of these tools means this capability will proliferate rapidly.
Defenders must now assume that attackers can conduct always-on, adaptive reconnaissance against their perimeter. The window between vulnerability disclosure and exploitation is shrinking, and the cost of attacking at scale is trending toward zero.
Shield53 Recommendations
The age of autonomous AI-driven cybercrime has arrived. Organizations that continue defending with manual processes and periodic scanning will find themselves systematically outpaced by adversaries who never sleep, never tire, and scale without limit.
