AI-Driven Attacks Compromise 27 Retailers for $25 per Target

An attacker has used a suite of open-source artificial intelligence (AI) tools to compromise 27 online retailers, with the cost of each successful breach averaging just $25.

Research conducted by the Israeli security firm Gambit revealed that the campaign targeted 105 retailers over a five-day period. The attacker utilised OpenRouter to access various AI models, significantly reducing the manual effort required to identify and exploit vulnerabilities.

Automated Exploitation via AI Harnesses

Gambit identified three specific open-source AI harnesses used to orchestrate the campaign. The attacker employed Strix to search for vulnerabilities, Cairn to conduct autonomous end-to-end exploitation, and Hermes to manage the overall campaign orchestration.

The automation allowed for highly efficient incursions, with most successful accesses taking only a few hours to complete. Financial records captured on 25 August indicated that the attacker spent a total of $7,005 over a four-week period. Costs per target ranged from as little as $3.13 to $79.31.

Significant Data Theft and Skimming

The scale of the theft was substantial. The automated attacks resulted in the theft of 600,000 active credit card details from two targeted businesses. Furthermore, card skimmer scripts were successfully installed at five additional retailers, and an unspecified number of major companies experienced some level of unauthorised access.

Gambit warned that the intensity and sophistication of these attacks signal a shift in cybercriminal activities. The use of AI provides a level of scale and speed that would be difficult for human actors to achieve manually, potentially leading to an increase in automated incursions against large-scale businesses.