Gambit: autonomous AI harnesses (Strix/Cairn/Hermes) hit online retailers ~US$25/target; 600k+ cards stolen
Gambit Security Threat Intelligence (blog dated 22 September 2026; interim report) reconstructed an ongoing financially motivated campaign from an exposed staging server: three open-source AI harnesses — Strix (autonomous vuln discovery), Cairn (end-to-end exploitation until shell/admin), and Hermes (orchestration / tactical guidance) — attacked hundreds of online retailers with human operators limited to brief Chinese-language prompts. Marginal cost cited at mean ~US$25.46 across 101 completed scans (range ~US$3–US$79); OpenRouter model spend estimated ~US$12k–US$18k over the observed window. Impact Gambit accounts for includes >600,000 unexpired card records from two victims (Overwatch Data: ~79% US issuers), skimmer scripts ordered against ≥27 named shops and confirmed on 19, and in some cases agent cleanup wiping Magento payment fields or dropping staging/backup tables. Example chain: unauth SQLi → plaintext OTP MFA bypass → web shell → sudo → NFS → AWS Secrets Manager → Magento card DB. Still running as of report; Shadowserver and partners helped notify victims and take down infrastructure. Distinct from desk closedquorum-talos-20260922 (Windows LLM-quorum implant) and Talos CAIRN hunting toolkit. Primary: Gambit Security; wire: Cyber Security News 22 Sep 2026.
- Product
- Open-source AI offensive harnesses Strix / Cairn / Hermes via OpenRouter; Magento and custom e-commerce stacks
- Exploited in Australia?
- unknown
- Patch to
- No CVE: inventory internet-facing custom e-commerce; patch SQLi/file-upload/MFA-OTP storage flaws; hunt checkout skimmers (library-append loaders, foreign script tags, gtag injection); monitor unexpected AI/OpenRouter API use from build or jump hosts; treat agent cleanup as destructive IR risk; rotate payment/Magento/AWS secrets after suspected access
Primary: Gambit Security — Autonomous AI agents hacking online retailers (~US$25/target) (22 Sep 2026) · Cyber Security News — amplify (22 Sep 2026)