Between July and September 2026, a financially motivated threat actor ran a coordinated campaign using three off-the-shelf AI tools to attack online retailers, end up stealing more than 600,000 credit card records, and even wiping victim databases. The operation was identified and reconstructed by threat intelligence experts who uncovered its scale, timing, cost, and mechanics.
How the Attack Worked
The attacker used Strix to scan retailers’ systems for vulnerabilities, Cairn for executing exploits and gaining system access, and Hermes to orchestrate the whole thing—including launching attacks, directing follow-ups, and managing cleanup. These tools worked together with minimal human intervention: between August 23–31 alone, Strix ran 146 intensive scans across 138 servers, using over 600 cumulative scanner-hours. Meanwhile, Hermes processed nearly 260 sessions with fewer than 2,000 operator commands, mostly simple instructions. The adversary also deployed models that allow for freedom of action—unrestricted open-model frameworks and more permissive off-shore models for sensitive or risky tasks.
Scale, Cost & Impact
Across over one hundred successful scans, the average cost to the attacker per compromised site was just about $25. Some targets cost under $4 to breach, while the most expensive cost nearly $80. Total spending over that timeframe was estimated between $12,000 and $18,000 in model access, backed up by account data showing a balance snapshot of more than $7,000 in late August.
The stolen data came from large retail and consumer-facing companies—ranging from fashion e-commerce to industrial supply, airlines, and high-tier hospitality brands. Two major victims alone accounted for the 600,000+ card records. Anti-fraud analysts verified that nearly 488,000 of those cards belonged to U.S. consumers, and many had not yet been flagged for fraud, highlighting how fresh the breach is.
In certain cases, after exfiltrating sensitive data, the attacker used cleanup routines that wiped card fields or dropped backup tables—even ones maintained by administrators. Embedded skimmers were found across dozens of checkout pages; methods included tampering with jQuery files, poisoning file storage buckets, using Kubernetes containers, cron jobs, and other persistent techniques.
Why It’s a Game Changer
This campaign matters far beyond its headline numbers. The tools are open source. Each breach costs the attacker just tens of dollars. And many targets were compromised within a day, while cleanup and mitigation for companies are still very time-consuming and resource-intensive. The attacker leveraged flaws known before public disclosure, making detection extremely hard.
Experts say traditional security tools—SOC alerts, human reviewers, incident response playbooks—aren’t built for this speed and volume. Because attackers are moving at machine pace, even frequent patching and standard defense protocols are insufficient to keep up.
Despite takedowns and cooperation with infrastructure groups, the campaign has continued—rebuilt and relaunched after parts were disrupted.
This episode marks a new level of sophistication in automated cybercrime. With open AI agents able to scan, exploit, exfiltrate, and self-clean on autopilot, the barrier to high-impact attacks is collapsing. Businesses need to assume they will be targeted, prioritize rapid patch cycles, invasive scanning, vigilant supply-chain hygiene—and invest in defense-in-depth approaches that can respond at machine speed.
