AI tools let hacker breach 27 retailers for $25 per target

September 25, 2026 at 10:57 PM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

A hacker used open-source AI tools to attack 105 online retailers over five days, compromising 27 of them at an average cost of $25 per attack, according to Israeli security firm Gambit. The campaign yielded 600,000 active credit card details from two businesses and installed card skimmers at five more. Gambit has contacted all affected companies.

Key Facts

The attacker spent $7,005 over a four-week period, averaging roughly $25 per attack, with costs ranging from $3.13 to $79.31.
Gambit identified three open-source AI harnesses used in the campaign: Strix for vulnerability search, Cairn for autonomous exploitation, and Hermes for orchestration.
The campaign compromised 27 of 105 targeted online retailers and stole 600,000 active credit card details from two businesses.
OpenRouter was used for AI model access, and most intrusions took just a few hours.

Attack Campaign

The attacker targeted 105 online retailers over a five-day period, compromising 27 of them. The campaign used open-source AI harnesses: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the attacks. OpenRouter provided AI model access, and most intrusions took just a few hours. Gambit has contacted all affected companies but warned that AI is transforming cybercriminal activity with a new level of sophistication.

Financial Impact

The attacker spent $7,005 over a four-week period, averaging roughly $25 per attack. Costs ranged from $3.13 for the cheapest target to $79.31 for the most expensive. The campaign stole 600,000 active credit card details from two businesses and installed card skimmer scripts at five more.