GoKawiilGambit Security finds AI-driven campaign breached 27 e-commerce sites for $25 each
Gambit Security reported that over five days in September, a Chinese-speaking attacker used three AI agent frameworks and both open-weight and public AI models to target 105 e-commerce sites, compromising at least 27, including a Fortune 500 company. The attackers stole over 600,000 payment card records from two targets and installed skimmers on five others, spending an average of $25.46 per successfully breached target. Separately, Silverfort researchers said a lab test using Claude Opus achieved full domain compromise from initial access in eight minutes for about $12.
GoKawiil's interpretation of the reporting above, not reported fact.
These findings suggest that agentic AI tools are collapsing the cost and skill barriers that once limited large-scale cyberattacks to well-resourced teams, potentially letting a single operator achieve outcomes once requiring coordinated hacking groups. Gambit's Sa'ar Elias and Silverfort's Colin Ferris both frame this as a structural shift in who can carry out sophisticated intrusions, implying defenders may need to prepare for a broader and less predictable pool of attackers. The real-world scale of the e-commerce campaign, paired with the speed of the lab-based domain compromise, points to AI lowering both cost and time-to-breach simultaneously.
- An AI-driven campaign compromised 27 of 105 targeted e-commerce sites in under five days at ~$25.46 per successful breach, per Gambit Security.
- At least 600,000 payment card records were stolen from two victims, with skimmers installed on five sites and one Fortune 500 company affected.
- Separate Silverfort lab tests showed AI agents achieving full domain compromise from initial access in just eight minutes for about $12.
YubiKey 5C NFC Security Key — As AI-driven attacks scale up and compromise e-commerce accounts at record speed, strong hardware-based authentication is more important than ever. A YubiKey adds a physical layer of security that can't be phished or brute-forced by automated agents, helping protect your accounts even if passwords or payment data get exposed elsewhere.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Robert Lemos, 2026-10-23
Published there as: “AI Tools Are Generating Massive Attacks for Little Cost”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.