AI agents are now running live credit card skimming operations
A campaign that compromised more than 100 e-commerce sites and stole over $600,000 in payment card data ran on the Hermes AI agent framework, using Claude Opus 4.6 as its reasoning engine. The cost per stolen card: roughly $25. That math changes the threat model for any organization that handles card data directly.
What the campaign did
Operators deployed Hermes agents against e-commerce checkout pages. Each agent analyzed the target site's payment form, generated site-specific injection code, validated that the exfiltration channel was live, and moved to the next target when the job was done. The campaign ran autonomously across more than 100 sites over several weeks. Stolen card data sold for roughly $25 per record. Total identified theft exceeded $600,000, though downstream costs to affected merchants and cardholders are substantially higher.
Why this changes the threat model
Earlier skimming campaigns required an operator to manually configure each site's form-field selectors and injection logic. That labor cost limited scale. Hermes removes the bottleneck: the LLM reads the page, identifies the relevant form fields, writes the injection payload, and tests it. What previously required specialist operator time per site now runs at the cost of cloud compute and API calls. The marginal cost of adding a hundredth target site is near zero.
Scale and economics
The attacker's cost advantage is real. Processing fees, chargebacks, and fraud investigations cost card issuers and merchants significantly more than $25 per event. A campaign that nets $600,000 while spending a few thousand dollars on compute is attractive by any criminal economics standard. Expect this approach to propagate across threat groups that have adopted commodity agent frameworks.
What e-commerce operators should do
The most durable mitigation is to stop handling card fields directly. Migrating to a fully hosted payment form, where card input lives on the payment provider's domain rather than your site, removes your checkout page from the attack surface entirely. If migration is not immediately possible: enforce a strict Content Security Policy with a script-src directive that blocks unauthorized scripts; audit all third-party JavaScript loaded on checkout pages, since skimmer code commonly enters through compromised analytics or support chat widgets; deploy file integrity monitoring on your checkout templates; and review subresource integrity attributes on any externally hosted scripts.
The Hermes connection
Hermes has appeared in two distinct attacker campaigns disclosed this week: this credit card skimming operation and the Carbonato botnet, which uses the same framework to autonomously identify and hijack vulnerable Docker hosts. Two separate campaigns sharing infrastructure suggests Hermes is available as a service or licensed toolkit on criminal forums, consistent with the commodity exploit kit pattern. Security teams building threat hunt criteria for AI-assisted attacks should add Hermes-characteristic agent behaviors to their detection coverage.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team needs help assessing your checkout page attack surface.