Actor Profile

A financially motivated threat actor, believed to be Chinese-speaking based on operational indicators, is conducting large-scale automated attacks against online retailers using open-source AI agent frameworks. The operator provides high-level objectives to autonomous AI tools that handle reconnaissance, exploitation, and post-compromise activities with minimal human intervention. The campaign demonstrates a shift toward AI-augmented cybercrime operations that enable less-skilled actors to execute sophisticated attacks at scale with marginal per-target costs averaging $25. Active since at least July 2026, the operation has compromised 119+ websites and stolen over 600,000 payment card records from retail and e-commerce organizations.

TTPs (Tactics, Techniques, Procedures)

The campaign leverages three AI frameworks in sequence: Strix (penetration testing/vulnerability discovery), Cairn (autonomous exploitation engine for obtaining shells and admin access), and Hermes (orchestration using claude-opus-4.6 LLM with 121 skills including 78 attack-related capabilities). Initial access methods vary based on discovered vulnerabilities. Payment skimmer deployment techniques include: appending malicious code to legitimate JavaScript files (T1059.007), modifying checkout pages and Google Tag Manager blocks (T1505.003), poisoning S3/CDN content and server-side caches (T1584.004), altering database fields (T1565.001), modifying Kubernetes deployments (T1610), and establishing persistence via cron jobs (T1053.003). Post-exploitation includes data exfiltration (T1041) followed by automated cleanup routines that wipe source card data from Magento databases in batches (T1485), causing operational disruptions. The attacker uses traffic-ranking services for target prioritization, focusing on organizations running custom software.

Targets & Patterns

The campaign targets retail and e-commerce organizations with online payment processing capabilities. Victims include a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor, and an online fashion retailer. The attacker prioritizes high-traffic websites identified through traffic-ranking services and specifically seeks targets running custom software, presumably due to higher likelihood of exploitable vulnerabilities. Between September 10-15, 2026, the operator launched 105 distinct attack waves with varying success rates, compromising at least 27 organizations in that five-day window. The broad targeting approach—enabled by AI automation and low per-target costs ($3.13 to $79.31, mean $25.46)—allows the actor to attack tens of companies daily. Two compromised organizations alone yielded over 600,000 valid payment card records, demonstrating focus on high-value data theft from organizations processing significant transaction volumes.

Historical Context

This campaign represents an evolution in financially motivated cybercrime, marking one of the first documented cases of threat actors weaponizing open-source AI agent frameworks for large-scale payment card theft. The operation has been active since at least July 2026 and remained ongoing as of September 22, 2026. Between August 23-31, the Strix scanning framework executed 146 runs against 138 hosts, accumulating 633 scanning hours. The campaign's automation-first approach—where AI agents autonomously handle reconnaissance, exploitation, and post-compromise activities based on brief human instructions—signals a paradigm shift in cybercrime economics. The marginal cost structure ($12,000-$18,000 total operational costs over four weeks, $25 average per target) enables threat actors with limited technical skills to conduct sophisticated attacks previously requiring manual expertise. This aligns with broader industry observations of AI-augmented attack tooling lowering barriers to entry for cybercriminals.

Defensive Recommendations

  • Deploy behavioral detection for rapid sequential exploitation attempts across multiple hosts; monitor for compressed attack timelines (hours vs. days) indicative of AI-augmented reconnaissance and exploitation (T1595, T1190)
  • Implement file integrity monitoring (FIM) on web application JavaScript files, checkout pages, and CDN/S3 content to detect unauthorized modifications associated with skimmer injection (T1505.003, T1059.007)
  • Monitor for suspicious cron job creation and Kubernetes deployment modifications that establish skimmer persistence mechanisms (T1053.003, T1610); alert on unexpected scheduled tasks in production environments
  • Establish database activity monitoring with alerts for bulk data access patterns followed by field-level deletions in payment processing tables, particularly in Magento and similar e-commerce platforms (T1565.001, T1485)
  • Conduct regular vulnerability assessments of custom-developed web applications and prioritize patching; implement web application firewalls (WAF) with rules targeting common exploitation vectors used by automated scanning tools