AI-Driven Cyberattacks Target Online Retailers at a Cost of Just $25 Per Breach

Once a vulnerability is identified, Cairn takes over. Cairn is described as an autonomous end-to-end exploitation engine. It does not merely flag a hole in the security; it actively works to bypass defenses, gain entry, and establish a foothold within the target’s infrastructure. Because it is powered by large language models (LLMs) capable of understanding and generating code in real-time, it can adapt its tactics on the fly, reacting to security measures as it encounters them.

The third component, Hermes, serves as the orchestrator. It manages the broader campaign, coordinating the actions of Strix and Cairn across multiple targets simultaneously. Hermes allows a single operator to manage dozens or hundreds of concurrent attacks, providing a level of scale that was previously the sole province of well-funded state-sponsored groups or large-scale organized crime syndicates. By using OpenRouter to access the necessary computational power, the attacker was able to run these sophisticated models without needing to maintain an expensive private server infrastructure.

The Human and Financial Cost of Compromise

The results of this five-day blitz were devastatingly productive for the attacker. Gambit’s investigation revealed that 600,000 active credit card details were exfiltrated from just two of the compromised businesses. This volume of data, if sold on the dark web or used for fraudulent transactions, represents a profit margin that dwarfs the $7,005 initial investment.

In addition to direct data theft, the attacker successfully installed card skimmer scripts at five other retail sites. These scripts are particularly insidious because they sit silently on the checkout pages of legitimate websites, capturing customer payment information in real-time as it is entered. Unlike a one-time data breach, a skimmer can provide a steady stream of fresh data for as long as it remains undetected.

The researchers also noted that the attacker gained varying levels of access to an unspecified number of major companies. The implications of this are broad; even if credit card data was not immediately stolen, the presence of an autonomous agent within a corporate network can lead to the theft of intellectual property, the deployment of ransomware, or the compromise of employee credentials.

Gambit has taken steps to mitigate the damage by contacting all the affected companies. However, the sheer volume of targets and the speed at which they were compromised suggests that many retailers are ill-prepared for the velocity of AI-driven threats. The notification process itself is a challenge, as many organizations may not even be aware that a breach has occurred until the stolen data begins appearing in fraudulent transactions.

The Transformation of the Cybercrime Landscape