Gambit reports hacker uses AI tools to attack online retailers

Security company Gambit reported that an attacker targeted 105 online retailers over five days and successfully compromised 27 of them. The attacks utilized open-source tools including Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes to orchestrate the campaign. OpenRouter was used to provide access to the underlying AI models. This campaign resulted in the theft of 600,000 active credit card details from two businesses.

Card skimmer scripts were also installed at five additional businesses alongside access gained to other major companies. An account balance check on August 25 showed total spending of $7,005 over a four-week period. This amounted to an average cost of $25 per attack, with individual costs ranging from $3.13 to $79.31.