AI AGENTS ARE HACKING ONLINE RETAILERS FOR $25 A COMPANY

Summary from the TLDR InfoSec newsletter

A financially motivated operator ran three open-source AI harnesses (Strix, Cairn, and Hermes) against hundreds of online retailers from July to mid-September, spending roughly $12,000–$18,000 on AI model calls. The campaign exfiltrated over 600,000 unexpired credit card records from two victims, injected skimmers into at least 27 sites, and achieved access to assets of a Fortune 500 hospitality firm, a major US airline, and other large retailers. In several breaches, the agent executed a "database wipe after extraction" routine that deleted payment data and, in one case, dropped 180 tables including backups.