Open-source AI pentesting harnesses (Strix, Cairn, Hermes) run an autonomous intrusion-and-skimmer campaign against online retailers for about $25 a target

Gambit Security's Threat Intelligence team recovered a financially motivated operator's exposed staging server and reconstructed a campaign, running since July 2026, in which three off-the-shelf open-source AI agent harnesses conduct nearly the entire intrusion lifecycle unattended against online retailers. Strix, an open-source AI pentesting tool run via OpenRouter (GLM 5.2, later switched to DeepSeek v4 Pro), performs autonomous vulnerability discovery, 146 deep-mode scans against 138 hosts between 23–31 August 2026, burning 633 hours of scanner time within 195 hours of wall-clock time. Cairn, an autonomous exploitation engine on DeepSeek v4.1 Flash, receives a target domain and an objective and runs unattended for hours until it gets a shell or admin access: "between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees" (Gambit Security, 2026-09-22). Hermes, the same open-source "Hermes AI agent" (Nous Research, persistent daemon, self-authored skills, unattended execution) previously observed in three unrelated intrusions: an operation against Thailand's Ministry of Finance that a low-to-medium-confidence assessment linked to a Chinese-speaking operator without establishing a firm nexus (2026-07-25); a Taiwan government intrusion Tenable's own analysis assesses as more likely a state-adjacent contractor or patriotic-hacker operation than direct state sponsorship (2026-08-28); and a self-described Zhuhai-based, Chinese-speaking operator's mass-exploitation campaign against more than 460 targets including a Malaysian government entity, with no firm state-nexus attribution established (Unit 42, 2026-07-30; see the 2026-07-31 entry), orchestrated the campaign end to end, running on Anthropic Opus 4.6 ("after newer models refused its requests") under a Chinese system persona the operator loaded, titled "SOUL - Red Team Operator". The operator had added a custom skill that strips Hermes's own content-safety filters, and drove the campaign through only 1,951 short, largely Chinese-language operator prompts across 260 sessions; most of the actual attack work ran autonomously between those prompts.

One fully documented Cairn project illustrates the chain, though Gambit is explicit that each victim's actual path was chosen dynamically through real-time probing and most chains differed victim to victim: unauthenticated SQL injection in a login email parameter (error-based EXTRACTVALUE) read a one-time-passcode value in plaintext directly from an application database table, bypassing multi-factor authentication and reaching the admin panel; an image-upload field with no extension check then gave host remote code execution as a non-root user; a sudo misconfiguration allowing NOPASSWD execution of python3.12 escalated that to root; an internal NFS mount configured with no_root_squash let the agent read a separate host's WordPress database credentials in plaintext from its wp-config.php; those credentials gave a direct database write creating a new WordPress administrator account, which in turn let the agent upload a malicious plugin for code execution on the blog host; from there the agent dumped the full contents of the account's AWS Secrets Manager (46 secrets, 102 KB), reached the production Magento database on Amazon Aurora, extracted the Magento application's encryption key, and used it to decrypt stored card numbers encrypted with Blowfish in ECB mode. Confirmed impact across the campaign: 600,000-plus unexpired credit-card records exfiltrated from two victims, live checkout-page skimmer scripts confirmed on 19 of 27 named victims (100-plus further sites found via a shared skimmer signature), and partial-to-full compromise reaching a Fortune 500 hospitality company, a major US airline, a large US industrial-supplies distributor and a US online fashion retailer, named separately by Gambit as categories of accessed victims, not as the source of the illustrative chain above. A per-country cardholder breakdown embedded in Gambit's own page (488,372 of the recovered cards, 79.0%, United States) skews overwhelmingly toward the United States; no Swiss-issued cards appear among the top entries of that table (Gambit Security, 2026-09-22).

Gambit documents eight distinct skimmer-injection methods used across victims, all worth carrying into any custom-web-application hardening review: appending the loader to the end of a legitimate, already-served JavaScript file while restoring its original modification timestamp; inserting a foreign <script> tag directly into the checkout page; hiding the loader inside a site's Google global-site-tag (gtag.js) block, between the real gtag('js', ...) and gtag('config', ...) calls, padded with roughly a hundred tab characters to push it past the right edge of a typical code-review view; using a discovered AWS access key to write the loader into the storage bucket behind the retailer's own CDN, so it loads from that trusted CDN host rather than a third-party domain; injecting the loader into a database content field (such as a product-description column) via the admin panel and relocating it to a file on the victim's own domain; adding it as a Kubernetes initContainer in a production front-end deployment manifest; writing it directly into a server-side page-cache entry for the checkout page, so the served HTML differs from the page's own template; and a self-healing cron job placed in a JBoss log directory that checks the injected file's size every two minutes and re-appends the loader whenever a redeploy reverts it. One of Hermes's self-written skills, titled "Database Wipe After Extraction", instructs the agent: "after extracting and downloading all card data, wipe the source fields in batches" (Gambit Security, 2026-09-22); at a second victim, a bicycle retailer, an overly broad table-name-matching cleanup step additionally dropped 180 staging and backup tables, including backups the victim's own administrators had separately made, collateral data loss from the attacker's own automated cleanup, not extortion. Some targets were not discovered by the agents at all: Gambit's operator handed at least two victims to Hermes already holding a compromised admin password obtained elsewhere, with the instruction to proceed directly to the objective. OpenRouter billing puts the operator's total spend at roughly $12,000–18,000 over the full campaign; "the operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive" (Gambit Security, 2026-09-22). Gambit states it "reached out to many of the affected organizations and took measures to take down the infrastructure discovered," crediting the Shadowserver Foundation, researcher Daniel Gordon, and other industry partners for their help notifying victims and taking down infrastructure (Gambit Security, 2026-09-22).

Detection concept, telemetry class first: in web-server access logs, alert on SQL-error-pattern responses (EXTRACTVALUE or equivalent) to login-form parameters, and on image-upload requests whose stored file is later executed by the web server rather than served as static content; in host telemetry, alert on sudo invocations of an interpreter (python3.12 or similar) by a low-privilege account with no corresponding change-management record; in network/mount telemetry, flag any host mounting an NFS export it has not mounted before, particularly where the export allows root-equivalent access; in cloud-audit telemetry, alert on a single principal enumerating or reading the entire contents of an AWS Secrets Manager instance in a short window; and in file-integrity or CDN-origin monitoring, treat any modification to a served JavaScript file's content (even with its timestamp preserved) or any script tag added to a checkout page outside a deployment window as high-priority. Triage: a legitimate deployment modifies checkout-page assets during a known release window with a corresponding commit and change record; the discriminators here are modification with no matching deployment event, a modification timestamp that has been deliberately restored to match the original file, or content padded with unusual whitespace specifically to evade a manual code read.

The Hermes tool now appears in four unrelated intrusions (this financially motivated campaign and the three above) each independently reaching for the same permissive, open-source agent framework and each disabling its safety rails before use. That convergence, not any single victim in this campaign, is the transferable signal for a defender: an increasingly capable, freely available agent orchestration layer is now common tooling across financially motivated operators and government-targeting intrusions alike, regardless of how firmly any of them is ultimately attributed, and the underlying attack chain here (SQL injection, insecure OTP storage, unrestricted file upload, sudo misconfiguration, an over-permissive NFS export, and cloud-secrets exposure) is entirely composed of defects a Tier 2/3 team already reviews for in any custom-coded web application, Swiss public-sector portals included.