AI-Powered Retail Attacks: What the 2026 Campaign Reveals

By Greyhawk Manila
September 26, 2026
AI & Digital Intelligence, AI Forensics & Cyber Threats, Cyber Threat Intelligence, Digital Forensics, Retail Forensic Investigation
0 Comment

When the Attacker Has AI: Inside the Campaign Targeting Online Retailers

For years, cybersecurity teams have been told to prepare for faster attacks.

The latest campaign targeting online retailers raises a different question:

What happens when the attacker can automate the work between finding a weakness and exploiting it?

According to research from cybersecurity firm Gambit, a financially motivated threat actor has been using multiple autonomous AI systems to target online retailers since at least July 2026.

Between September 10 and 15 alone, Gambit identified 105 attack projects, with at least 27 companies compromised to varying degrees. More than 600,000 unexpired credit-card records were stolen from two companies, while skimmer scripts were injected into multiple online stores.

The significance is not simply the number of victims.

It is the operating model.

A human was still directing the campaign.

But much of the repetitive work between instruction and outcome was being performed by AI-powered systems.

And that changes the forensic problem.

What happened in the AI-powered retail campaign?

Gambit’s investigation found three open-source AI harnesses being used across different stages of the operation:

Strix for vulnerability research
Cairn for autonomous penetration-testing and attack projects
Hermes for orchestration, intrusion activity, tactical guidance, and post-compromise tasks

This was not simply a chatbot being asked to write malicious code.

The systems were being used as components in a broader attack workflow.

Gambit reported that Strix was run 146 times in deep mode against 138 hosts between August 23 and 31.

The resulting reports were then passed to Cairn, which launched 105 attack projects between September 10 and 15.

Hermes was subsequently used as the orchestration layer.

Gambit identified 1,951 human prompts across 260 sessions, with the human operator generally providing short instructions rather than manually directing every technical step.

That distinction matters.

The human did not disappear from the attack.

The human’s role changed.

The human operator became the coordinator

The campaign provides an important reminder about how AI-enabled attacks should be understood.

It would be inaccurate to describe this simply as:

“AI hacked hundreds of companies.”

The available evidence describes a human-directed operation using AI-powered tools to automate significant portions of reconnaissance, exploitation, orchestration, and post-compromise activity.

Gambit assessed the operator as Chinese-speaking and financially motivated. That is an attribution assessment from the investigating cybersecurity firm, not a definitive identification of a named threat actor.

The more useful lesson for defenders is therefore not who typed the prompts.

It is what happened after the prompts were entered.

The attack chain became a pipeline

Traditional intrusion investigations often reconstruct activity as a sequence:

Reconnaissance → Exploitation → Access → Privilege → Data → Persistence

The campaign described by Gambit demonstrates what happens when several parts of that sequence become automated.

The attacker could:

Identify targets → look for weaknesses → attempt exploitation → pursue access → move toward valuable systems → extract data → establish persistence → perform cleanup

without requiring the human operator to manually perform every step.

This creates a very different defensive problem.

A security team may have separate processes for:

vulnerability management;
threat hunting;
incident response;
identity monitoring;
application security;
payment security;
database protection;
recovery.

The attacker does not necessarily care about those organizational boundaries.

Why online retailers were attractive targets

According to Gambit’s reconstruction, the operator used a website traffic-ranking service to identify potential targets and focused on retailers running custom code. A human operator reportedly supplied 301 results to the attack infrastructure, while also selecting some targets where administrative credentials were already available.

For an attacker, online retailers can represent an attractive combination:

Large customer base + payment environment + internet exposure + complex applications + valuable data.

But the campaign also demonstrates why “we are too small to be targeted” is becoming a weaker assumption.

Automation changes the economics.

The economics of the attack changed

One of the most striking findings from Gambit’s investigation was cost.

Based on recovered information, Gambit estimated an average cost of approximately $25.46 across 101 completed scans. Individual attack projects could cost only a few dollars.

That does not mean an entire successful breach costs $25.

It means the cost of automated attack activity can become extremely low.

And that creates an uncomfortable security equation:

If attacking becomes cheap enough, the attacker does not need every target to be valuable.

They only need enough successful outcomes to make the campaign worthwhile.

This is one reason automation matters so much.

More than stolen card data

The campaign was not limited to database theft.

Gambit found evidence of skimmer scripts being injected into online stores.

The skimmers were identified in multiple locations, including JavaScript files, checkout-related components, cloud storage, database content, and other parts of the web application environment. Gambit initially confirmed 19 victims and, working with security researcher Varys, identified more than 100 additional infected websites.

This matters because a retailer can appear operational while the checkout environment has been compromised.

The website still loads.

Customers can still browse.

Orders may still process.

The business may still be making money.

But somewhere in the transaction path, malicious code may be observing or capturing payment information.

That is not merely a website-security problem.

It is a business-continuity, payment-security, customer-trust, and forensic-investigation problem.

Persistence changes the investigation

One detail reported by Gambit is particularly relevant to digital forensics.

At one US wine retailer, redeployment restored a clean checkout bundle.

But the attacker had left a scheduled mechanism that monitored the file and restored the skimmer when the clean version appeared.

That creates a critical forensic lesson:

Removing the visible malicious code does not necessarily remove the compromise.

An investigator has to ask:

What mechanism put it there in the first place?

And then:

What mechanism could put it back?

This is why simply restoring a known-good website file may not be sufficient.

The investigation has to examine the surrounding environment.

The attacker also attempted cleanup

Gambit reported evidence that the Hermes agent had a skill designed to delete stolen card data from a victim’s Magento database.

The researchers also found evidence of database backup-table deletion at another victim after the agent was instructed to remove certain staging tables.

This introduces another important forensic problem:

What happens when the attacker attempts to destroy evidence while the attack is still underway?

Investigators then have to distinguish between:

legitimate administrative activity;
automated application behavior;
attacker-created changes;
attacker-triggered deletion;
recovery activity;
and evidence that disappeared before investigators could collect it.

That is where timelines become essential.

AI does not eliminate the need for human investigators

It may actually increase it.

An AI-driven attack can generate more events, more variations, more access attempts, and more potential evidence.

The challenge becomes:

Which events matter?

A security team may see hundreds of alerts.

An investigator needs to determine which sequence represents the actual intrusion.

That requires correlation.

For example:

The individual events may not look extraordinary in isolation.

The sequence can be.

The forensic question changes

Traditional incident response often asks:

“How did they get in?”

That remains important.

But AI-assisted attacks require additional questions:

How quickly did they move after gaining access?

Which decisions were automated?

What actions were initiated by the human operator?

What actions were selected or executed by the AI system?

What systems did the automated workflow reach?

What evidence was modified or deleted?

What happened between detection and containment?

The answers help reconstruct not only the attack, but the operating model behind the attack.

What should retailers investigate now?

Retailers do not need to assume that every AI tool is an attacker.

They do need to understand that automated attack workflows can compress the time available for defense.

A practical investigation should examine several layers.

1. Internet-facing assets

Know what is actually exposed.

Websites, APIs, administration interfaces, cloud services, forgotten subdomains, development environments, and other externally accessible systems can become part of the attack surface.

2. Application integrity

Do not only check whether the website is online.

Determine whether:

checkout scripts changed;
JavaScript changed;
tag-management configurations changed;
cloud-hosted assets changed;
database content changed;
deployment artifacts changed.

3. Identity and access

Review:

administrator accounts;
service accounts;
API credentials;
sessions;
privileged access;
unusual authentication patterns.

4. Persistence

Ask what could allow malicious activity to return after remediation.

A clean file does not necessarily mean a clean environment.

5. Payment environment

Retailers should establish exactly where payment information is handled and what components can interact with that environment.

6. Logs and timelines

Preserve relevant evidence before normal system activity overwrites it.

The investigation should establish:

7. Recovery

Recovery should not simply mean:

“The website is back.”

The more important question is:

Can we prove that the systems supporting the business are clean enough to operate again?

The new race is not AI versus AI

It is tempting to frame cybersecurity as:

Attackers have AI. Defenders need AI.

That is incomplete.

The deeper problem is time.

If an attacker can discover and exploit a weakness in hours while an organization needs days to identify ownership, approve remediation, deploy a fix, validate the environment, and recover operations, the organization may already be behind.

AI is accelerating one side of that equation.

Organizations need to examine whether their own:

process can keep up.

What this means for digital forensics

The campaign also reinforces something Greyhawk Manila considers fundamental:

Digital forensics cannot begin only after everything has stopped.

The evidence generated during the incident can determine what investigators are able to establish later.

That means organizations need to think about:

evidence preservation;
reliable timestamps;
centralized logging;
identity telemetry;
application integrity;
cloud activity;
database activity;
endpoint evidence;
payment-system activity;
configuration history;
backup integrity.

If those records do not exist, the investigation becomes a reconstruction based on incomplete evidence.

And the more automated the attack becomes, the more important that evidence can become.

Greyhawk Manila Perspective

The most important lesson from this campaign is not that AI can hack.

We already knew automated tools could be used offensively.

The more important development is the scale, speed, and economics of the workflow.

One human operator can direct multiple AI-powered systems.

Those systems can continuously perform different parts of the attack.

And when the cost of attempting another target becomes very low, the economics of cybercrime change.

For defenders, that means security cannot depend entirely on the assumption that an attacker will move slowly.

The question becomes:

If an attacker can move in hours, how quickly can we detect, investigate, contain, and recover?

And after an incident:

Can we reconstruct what actually happened from the evidence?

Because when the attacker is automated, the investigation has to be ready for the same reality.

The attack may be automated. The accountability cannot be.

Greyhawk Manila
Cybersecurity • Digital Forensics • Intelligence

Blog Single