$25 스키머: AI 착취 및 유출

AI is improving attackers’ ROI. You need to change the status quo. 

In a five-day window this September, a single attacker ran three chained AI systems against roughly 100 online retailers, breaching at least two dozen of them at an average cost of about $25 per company — and walked away with the payment data of hundreds of thousands of shoppers. 

That $25 figure is the story. Gambit Security, the threat intelligence firm that uncovered the campaign after the attacker’s own staging server was left exposed, put it plainly: this is “one of the most severe abuses of AI for exploitation seen so far.” Gambit called the pace “astounding for that amount of time.” And the report’s conclusion is the part worth sitting with longer than the headline: at very low cost, the AI tooling sustained a level of patience and persistence most human attackers wouldn’t for an attack like this, and it achieved far greater results, far faster than a human-operated campaign would. Security teams, the report argues, need to shift to a resilience-first mentality and a stack that matches AI speed — not just better locks on the doors that already exist. 

실제로 일어난 일 

Since July, one attacker has been running three open-source AI “harnesses” in sequence: one for reconnaissance, one for autonomous exploitation, and one for orchestration. In the tightest window observed — September 10 to 15 — that pipeline launched 105 attack projects and compromised 27 or more organizations (independent reporting from Forbes puts the number at “at least 30”). The attacker’s own server held records on 618,000 credit cards, about 488,000 of them belonging to Americans; an independent fraud-analytics firm, Overwatch Data, verified the data was real and unique, not padded or recycled. Magecart-style skimmers were confirmed live on at least 19 checkout pages. 

The victim list runs the full range a CISO should actually worry about. A hospitality company and an airline with $10 billion-plus in annual revenue, a fashion retailer over $1 billion — but also a gun dealership in Minnesota and a beauty retailer in Illinois. If your instinct on reading a headline like this is “that’s a Fortune 500 problem,” the campaign itself argues otherwise. 

Victims get a payment skimmer 

How the attacker got in varied across enterprises — SQL injection, an exposed admin panel, a leaked cloud key, a vulnerable plugin. That variety is actually the point: at AI-driven speed and cost, the entry vector stops being the differentiator.  

What most victims shared was the monetization step. Once in, the skimmer had to land on the checkout page and the stolen data had to leave the site. That’s the stage that’s common to all of it, regardless of how the attacker got the door open — and it’s the stage we can speak to directly. 

We’re not going to claim App Hardening for Web: Browser would have stopped the SQL injection or the cloud misconfiguration that got these attackers in the door. What we can speak to is the injection and exfiltration itself — the part of the chain that’s identical across nearly every skimmer campaign, including this one. 

Defending against the next attack 

This story and others in the news recently repeat the same message. AIs exploit lots of tricks to get inside. What happens next depends on the protections that you have in place. 

Two capabilities in App Hardening for Web: Browser map directly onto this. The first is checkout-page script and DOM integrity monitoring — in our product, the Web App Integrity Guard — which watches for scripts or URLs being added or changed on a protected page. The second is outbound-request allowlisting — the In-App Firewall Guard — which watches where a page’s background requests actually go and flags or blocks anything outside an approved list. 

We didn’t want to just take our own documentation’s word for how these behave, so we ran the test ourselves: a small protected page with a legitimate static script already in place, then a simulated skimmer injection (a new script tag added at runtime) and a simulated exfiltration call (a fetch to a domain never on the allowlist). The static script, present when protection was applied, triggered nothing. The moment the dynamic script tag was added, Web App Integrity Guard fired. The moment the exfiltration call went out, In-App Firewall Guard fired. Every skimmer variant in this campaign, however it got planted, ends the same way — a call out to attacker-controlled infrastructure — which is exactly the step this catches regardless of how the skimmer was planted. 

Defense in depth, not a single layer 

This addresses one link in the chain — the injection and the exfiltration. It’s good, but not enough. Closing off how attackers get in is a separate job: the SQL injection flaws, the exposed admin panels, and the leaked cloud keys that opened the door for several of the victims. If a hardcoded API key or cloud credential is sitting exposed in your codebase or mobile app right now, that’s a different control — see our companion piece on the ShinyHunters secret-harvesting campaign. Neither replaces the other; together they’re the resilience-first stack the report itself is calling for, covering different stages of the same attack. 

테이크 아웃 

The entry vector into a retail environment will keep varying — that’s what makes this campaign a preview rather than an outlier. The exfiltration step won’t. If your checkout page can’t tell the difference between the script you put there and the one an AI agent added five minutes ago, then a $25 attack is a rounding error next to what fraud and remediation actually cost you. Happy to walk through what that looks like against your own checkout flow.