AI Agents Are Breaking Into Online Stores for $25 Each: What to Check on Your Checkout

Security firm Gambit Security reports that one operator used three open-source AI tools to break into online stores for an average of $25.46 a target. Where it worked, access usually took under a day, and the goal was often a card-stealing script on the checkout page. The campaign has run since July 2026. Most targets were custom-built stores, but the last step looks the same on any platform.

The report is an interim one, and it is worth reading closely because the numbers are specific.

What did Gambit Security find?

Gambit's threat intelligence team recovered the operator's staging server and rebuilt the campaign from what was on it. Their interim report, published September 22, 2026, counts 105 attack projects launched between September 10 and 15 and at least 27 companies compromised to varying degrees. It says the activity goes back to July and was still running.

Three AI tools did most of the work. One searched for weaknesses, one tried to turn a weakness into access, and one coordinated the campaign. The human typed short instructions: 1,951 prompts across 260 sessions, which Gambit describes as only a few prompts per target.

The damage Gambit could account for includes at least 600,000 unexpired card details from two companies. About 79% of those cards were issued in the United States.

Why does $25 a target change the math for small stores?

Because the old reason to skip a small store was cost. A person's hours were worth more than a small store's cards. Gambit's own conclusion is that at these prices the economics no longer filter anyone out.

The figures behind that: the operator's cost review averaged $25.46 per target across 101 completed scans, from $3.13 for the cheapest to $79.31 for the most expensive. Gambit estimates total spend between $12,000 and $18,000 over roughly seven weeks, across hundreds of stores.

Speed is the other half. Gambit reports that access usually took less than a day, often a few hours, while fixes in complex environments are still measured in weeks. We covered the same gap in how AI shortens your detection window.

Which stores did the operator pick, and is mine one of them?

The operator started from a website traffic ranking service, chose the shopping category, and removed shops running the major hosted or open-source commerce platforms. The aim was to keep stores with custom code, which the attacker assumed were more likely to be vulnerable. Gambit says 301 results were pasted into the operator's console with an instruction to scan them through a proxy and report only high-severity findings.

So if you run on a major hosted platform, this operator's list was built to skip you. That is the honest reading, and it is also this operator's filter, not a rule the next one will follow.

Two things still apply. A custom theme, a custom checkout extension or an agency-built integration counts as custom code. And the final step, a foreign script running on checkout, can arrive through an ordinary app or tag as well, as Sucuri's warning on third-party scripts laid out.

Where did the skimmers hide?

Gambit found eight injection methods. A skimmer, in plain terms, is a script that copies card details as a shopper types them. It was ordered against at least 27 named victims, and with researcher Varys, Gambit found more than 100 further websites infected with a skimmer tied to the campaign. If you want the background on how these work, start with what a Magecart attack is.

The most common method, per Gambit, was the simplest to describe. A loader was added to the end of a normal library file such as jQuery, and the file's modified date was set back to the original so it looked untouched. Another was a plain script tag pointing at an unfamiliar domain, added to the checkout page.

The rest were harder to spot. One loader was written inside the Google tag block and pushed off screen with about a hundred tab characters. Others went in through a leaked key with write access to the storage behind a store's CDN, through product description fields in the database, and into the server's cached copy of the checkout page.

For a developer, Gambit publishes its indicators. The skimmer hosts include static-js[.]com, js-static[.]com, netlfjs[.]com, netlifyjs[.]com and x1opay[.]co (written here with the dots bracketed so they are not live links). The full list and the loader pattern are in the report.

Why didn't cleaning the file fix it?

At one wine retailer, redeploying the application restored a clean checkout file. The operator had left a scheduled job that checked the file every two minutes and added the skimmer back whenever it was reverted.

The lesson is narrow but useful. Removing the script without finding how it got there works until the next check runs. A clean copy is the start of cleanup, not the end.

What went wrong besides stolen cards?

Data loss. The operator's playbook included a step to erase card data from the victim's database after copying it. At a bicycle retailer, the agent created temporary tables, then its cleanup dropped 180 tables matching two name patterns, which included backup tables the store's own administrators had made.

Gambit's advice follows from that: assume data can be lost as a side effect of someone else's cleanup, and work out which systems make up the minimum viable business, meaning what you could not trade without. A backup that lives in the same database as the live data did not survive here.

What should a store owner do this week?

Six checks, none of which need a security team.

1. Get today's list of scripts on your cart and checkout pages. The step-by-step audit guide takes about fifteen minutes by hand. Our free Webpage Security Checker does it in about twenty seconds.
2. Look for any domain you do not recognize, and compare the list with last week's.
3. Ask your developer whether the files being served match your source code. Do not rely on file dates.
4. Ask who and what has write access to your CDN storage and admin panel, and remove keys nobody uses.
5. Check that a backup lives somewhere your live system cannot overwrite or delete, and that someone has tried restoring from it.
6. If you find something unfamiliar, save a copy before removing it, then tell your developer and your payment processor.

Keep watching after the first check

A single check shows you today. This campaign is a reminder that the interesting question is what changed since last week.

This is your store today. App updates, theme edits and new agency work change it, usually without anyone telling you. Run a free check, verify your domain, and keep it running.

Sources: Gambit Security, "AI Agents Are Hacking Online Retailers for $25 a Company," Eyal Sela, September 22, 2026.