Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs

1. Executive summary

A single Chinese-speaking operator used three open source AI harnesses (Strix, Cairn, Hermes) to run near-autonomous intrusion and card-skimming operations against hundreds of online retailers and other companies between late August and mid-September 2026, compromising at least 27 organisations and exfiltrating more than 600,000 credit card records from two of them. Victims named by Gambit, the AI security vendor that recovered the operator's staging server, include a Fortune 500 hospitality company, a major US airline, a large private US industrial supplies distributor, and a US online fashion retailer. The operator spent an estimated $12,000 to $18,000 in total, with a mean cost of $25.46 per completed scan, and injected card-stealing skimmer scripts into the checkout pages of at least 19 confirmed websites. No CVE, CVSS score, or CISA KEV entry is associated with this item in the verified reference data, so severity here is assessed on campaign impact rather than a patched vulnerability. EMEA financial services exposure is indirect but real: card data stolen from retail and hospitality checkout pages will surface as fraud on issuer portfolios, and the same agentic tooling is available to anyone targeting financial web applications.

2. Regulatory framing

No article is cited for the data theft alone. The theft of card records is a payment-data event that engages PCI DSS and, depending on the entity, national financial supervision; DORA and NIS2 incident reporting articles are not triggered by facts specific to this item as reported.

3. Technical analysis & attack chain

This is a threat-campaign item. The account below is reconstructed by Gambit from the operator's staging server, with additional infected-site detection by researcher Varys. The primary reporting is single-sourced to Gambit via The Register; treat the operational detail as vendor-attested rather than independently corroborated.

Confirmed steps in the campaign:

1. The operator loaded a Chinese-language system persona titled "SOUL - Red Team Operator" onto Hermes, an always-on AI assistant, with 121 skills, 78 of them attack skills. One skill removed the AI harness's content security filters.
2. Hermes acted as orchestrator, running on Anthropic's Claude Opus 4.6. Gambit reports newer models refused the attack requests. The operator typed 1,951 prompts in Chinese across 260 sessions.
3. Strix, an open source penetration testing tool, was run through OpenRouter on GLM 5.2 and later DeepSeek v4 Pro to search for exploitable vulnerabilities. Between August 23 and 31 the operator ran Strix 146 times in "deep mode" against 138 hosts, totalling 633 hours of scanner time in 195 hours of clock time.
4. Strix handed findings to Cairn, a second autonomous penetration testing tool running on DeepSeek v4.1 Flash. Cairn takes target domains and an objective (deploy a shell, achieve admin access) and runs until it succeeds, times out, or is stopped.
5. Between September 10 and 15, Cairn launched 105 attack projects. The AI selected each attack path in real time through probing and exploitation, producing different TTPs across victims.
6. In one documented intrusion the agent used SQL injection, obtained a plaintext one-time password, and accessed a web panel. From there it uploaded a web shell, escalated privileges through a misconfigured sudo rule, and reached AWS credentials, dumping 46 secrets totalling 102KB.
7. In two of the near-autonomous attacks, the AIs exfiltrated more than 600,000 credit card records from two victim companies.
8. Skimmer deployment was ordered against at least 27 named victims, with scripts confirmed present on 19 websites. Varys detected more than 100 additional infected sites linked to the campaign. The most common injection method was appending the skimmer code to an existing JavaScript file.

Cost and tempo are the operationally significant figures. The operator's own cost review put mean spend at $25.46 across 101 completed scans; the cheapest scan cost $3.13 and the most expensive $79.31. An August 25 account balance showed $7,005.71 spent over the previous four weeks, after which the operator continued for three more weeks at twice the daily volume of model calls. Gambit estimates total campaign cost at $12,000 to $18,000. Where access was achieved it usually took less than a day, and in many cases a few hours.

Two caveats. First, the attribution is to a Chinese-speaking individual operator, not to a named threat group; there is no MITRE ATT&CK profile for this actor in the verified reference data, so any group-level attribution is unconfirmed. Second, Gambit reports that the operator's playbook contained instructions that could disrupt a victim's operations through data deletion or cleanup procedures run by the agent, and that this happened in some of the breaches. That is a vendor claim about agent behaviour, single-sourced, and should be read as a risk of agentic tooling rather than a confirmed destructive capability.

4. Mitigation & containment

P1 within 24 hours

• Audit checkout and payment JavaScript for appended code. The campaign's dominant injection method was appending skimmer code to an existing JavaScript file, so compare served files against the last known-good build and diff for trailing additions. Any file that has grown without a corresponding release is a candidate.
• Enable subresource integrity or a content security policy that pins script sources on payment pages, so an appended block in an existing file is caught by hash mismatch rather than by manual review.
• Review sudo rules on internet-facing hosts for misconfigurations that permit privilege escalation from a web application account. The documented intrusion escalated through a misconfigured sudo rule before reaching AWS credentials.
• Rotate AWS credentials and any secrets reachable from web-tier hosts. The documented intrusion dumped 46 secrets totalling 102KB from AWS credentials obtained after privilege escalation.
• Search web-tier logs for SQL injection attempts followed by web shell uploads, and for access to web panels using a one-time password obtained in plaintext.

P2 within 72 hours

• Inventory any use of AI coding, scanning, or pentest agents against production systems, including OpenRouter or similar model-access brokers, and confirm what those agents are permitted to execute autonomously. The harnesses in this campaign ran with the ability to write and edit their own skills and to remove their own content filters.
• Restrict outbound access from web-tier hosts to the AWS metadata service and to credential stores, so a web shell cannot reach instance credentials directly.
• Add integrity monitoring on all JavaScript served from checkout, cart, and payment paths, with alerting on file modification outside a deployment window.

P3 within 7 days

• Reassess patch and exposure windows against the tempo this campaign demonstrated. Where exploitation arrives within hours of exposure, the recovery question is how fast dependent services can be restored, not only how fast a patch ships.
• Where agentic tooling is used in authorised testing, require scope limits, credential isolation, and a human stop condition, since the same autonomy that makes the tooling useful is what the operator exploited.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths) are present in the source material. The reporting describes tooling, model providers, and behaviours rather than artefacts suitable for enforcement.

Behavioural indicators:

No copyable indicator block is provided because the source contains no machine-pivotable atomic indicators.

6. Detection

The sources give no file hashes, mutexes, registry keys, or command-line strings from the malicious artefacts themselves. The named tools (Strix, Cairn, Hermes) are legitimate open source projects, and the model names and persona title are reporting artefacts, not threat artefacts. A YARA rule built on those names would detect reporting about the campaign, not the campaign.

Insufficient indicators to author detection rules.

Detection effort should instead go to the behavioural indicators in §5: JavaScript integrity monitoring on payment pages, SQL injection and web shell upload correlation in web logs, and anomalous sudo escalation from web application accounts.

7. Sources

• The Register, "Crook used three open source agents to break into a Fortune 500 hospitality company, a major US airline and 25+ other orgs", https://www.theregister.com/security/2026/09/25/crook-used-three-open-source-agents-to-break-into-a-fortune-500-hospitality-company-a-major-us-airline-and-25-other-orgs/5299012, 2026-09-24. Reporting on a Gambit alert by director of threat intelligence Eyal Sela, with additional infected-site detection by researcher Varys.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact, low-cost card-theft campaign with no associated CVE, CVSS score, or CISA KEV entry in the verified reference data, so severity is driven by the 600,000-plus card records exfiltrated and the 19 confirmed skimmer sites rather than by a vulnerability rating. The direct victims are retail, hospitality, and airline organisations, but the stolen card data will appear as fraud on EMEA issuer portfolios, and the tooling is cheap enough that the same approach will be pointed at financial web applications. The operational detail is single-sourced to Gambit and should be treated as vendor-attested; the attribution is to an unnamed Chinese-speaking individual, not a profiled group, and we do not treat it as confirmed. We will monitor for skimmer infrastructure and appended-JavaScript injection patterns across client payment pages, and we will update this advisory if independent reporting corroborates the Gambit account or if atomic indicators emerge. Clients running agentic tooling against production systems should treat the autonomy controls in §4 as the immediate action.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.