Image: csoonline.com · rights & removal

AI tools help hacker break in for $25 per target

Reporting by CSO OnlineRead the original at csoonline.com

Executive Summary

Sophisticated attacks were executed against online retailers using open-source AI tools, resulting in financial and data compromises. A group performed attacks on 105 online retailers over five days, compromising 27 of them for an average cost of $25 per attack. The attackers utilized specific open-source AI tools: Strix for vulnerability searching, Cairn for autonomous exploitation, and Hermes for campaign orchestration. These attacks yielded significant results, including the acquisition of 600,000 active credit card details from two businesses and the installation of card skimmer scripts at five additional locations. The operational efficiency was high, with most access gained in just a few hours and incurred minimal cost, evidenced by an expenditure of $7,005 over four weeks for account balance capture.

Facts Only

* 105 online retailers were attacked over five days.
* 27 of the retailers were compromised.
* The average cost per attack was $25.
* Attackers used open-source AI harnesses for execution.
* Tools identified include Strix (vulnerability search), Cairn (autonomous exploitation), and Hermes (campaign orchestration).
* 600,000 active credit card details were taken from two businesses.
* Card skimmer scripts were installed at five other businesses.
* Access was gained in just a few hours with minimal cost.
* Account balance capture over four weeks cost $7,005.
* Costs per attack ranged from $3.13 to $79.31.

Full Take

The narrative illustrates an escalation where accessible AI technology is being leveraged to lower the barrier to entry for high-impact cybercrime. The use of named, specialized open-source tools (Strix, Cairn, Hermes) shifts the threat from bespoke hacking by skilled individuals to automated, distributed attacks orchestrated by accessible frameworks. This signals a transition where offensive capabilities are democratized, meaning the sophistication witnessed is not unique to a few actors but reflects an emerging capability inherent in the tools themselves. The profitability derived from this automation—transforming minimal operational cost into substantial illicit gain—suggests a systemic shift toward leveraging readily available computation for exploitation, creating an environment where defensive measures must adapt to automated, low-cost threats rather than solely focusing on traditional human skill gaps. The implication is that defensive strategies must evolve to address the mass deployment of automated, cheap offensive agents operating at scale. What systems are in place to monitor and restrict the widespread distribution of these exploit tools? How does the perceived ease of using AI for offense alter the perception of cybersecurity risk for organizations?

From the original · CSO Online

Major retailers were hit by sophisticated attacks performed on the cheap. It’s cheap to set yourself up as a hacker these days using AI.

Read the full story at csoonline.com

Sentinel — Human

Confidence

The text reads like well-researched reporting grounded in technical findings, attributing specific operational details to an expert source.

Signals Detected

Sentence length variance is moderate; transitions are functional rather than purely mechanical.

The text flows logically from the specific incident to the broader implication without excessive hedging or forced balance.

Attribution points directly to a named source (Gambit) and specific tools, suggesting grounded reporting rather than pure fabrication.

Specific financial figures and tool names are presented clearly, which often anchors human-verified reporting on technical topics.

Human Indicators

The incorporation of specific, niche details (Strix, Cairn, Hermes, OpenRouter) and citing a named security firm (Gambit) suggests reliance on verifiable, specific data rather than generalized LLM extrapolation.