A single operator deployed AI agents against more than 1,200 websites, breaching sites belonging to over 100 companies, Reuters reported, in a campaign focused on online stores.
Beginning Sept. 25, the campaign targeted online stores across the United States, Canada, Japan and Australia. To probe each site, the operator relied on Cairn to coordinate the agents.
Cybersecurity firm NorForge counted more than 1,100 projects on 14 exposed Cairn dashboards linked to the busiest cluster it examined. That project tally is separate from Reuters’ count of attempted websites.
Instructions written in Chinese directed the agents to find exploitable access to shopping sites. NorForge assessed that the operator wanted to maintain access to commerce and payment systems for possible financial gain later. That motive was the firm’s assessment, not an instruction recorded on the dashboards.
At a hardware-parts vendor’s website, NorForge reached an uploader webshell and confirmed one claimed intrusion. Reuters could not determine whether the breaches in the main campaign led to unauthorized extraction of data.
Projects that met their objectives ran for an average of just under 23 hours, NorForge calculated. Reuters reported that NorForge principal threat researcher Snorre Fagerland put model spending near $5,000 overall and about $50 for each successful intrusion. The exposed dashboards showed no token-use totals with which to check those estimates.
Deere told Reuters it had taken remedial steps and found no indication that sensitive information was accessed. SharkNinja said it contained an intrusion involving a separate product-support site. Cummins said it was investigating a possible attack on a vendor-operated website.
NorForge also identified a separate Cairn operation whose English-language instructions called for stealing cryptocurrency and card data. Those instructions do not establish that theft occurred in the larger website campaign.
NorForge said it was helping notify affected organizations and seeking to have the exposed dashboards taken down.
