AI-Powered eSkimming Is Changing the Economics of Retail Attacks
Cybercriminals have found a way to make eSkimming attacks faster, cheaper, and easier to scale. Autonomous artificial intelligence (AI) agents can now perform much of the work traditionally handled by human attackers, from identifying vulnerabilities and gaining access to compromised systems to deploying malicious JavaScript on eCommerce websites.
New research from Gambit Security illustrates just how far this technology has advanced.
In September 2026, Gambit uncovered an active campaign in which a financially motivated threat actor used three autonomous AI tools to attack hundreds of online retailers. During a six-day period, the operation launched 105 attack projects, compromised at least 27 organizations to varying degrees, and deployed payment card skimmers on multiple websites.
The researchers also recovered evidence of more than 600,000 stolen payment card records from two compromised businesses. Perhaps the most concerning finding was the cost. The attacker’s own analysis estimated an average AI-related cost of just $25.46 per completed target scan.
For security leaders, the implications extend well beyond a single campaign. Attackers are demonstrating that large-scale reconnaissance, exploitation, and malicious code deployment can be conducted with remarkably little human involvement. And when the objective is stealing payment information, the customer’s browser remains a critical part of the attack.
Autonomous AI Is Accelerating the eSkimming Attack Cycle
Traditional eSkimming operations require attackers to identify vulnerable websites, gain access, deploy malicious code, and maintain their foothold long enough to collect valuable data. Each stage requires time and technical expertise. Attackers may use automated tools, but human operators have historically been responsible for interpreting results, choosing exploitation methods, and adapting to obstacles.
Autonomous AI agents are changing that process. In the campaign investigated by Gambit Security, the attacker used three open-source AI systems with different responsibilities. Strix searched for vulnerabilities. Cairn conducted autonomous exploitation, working toward objectives such as gaining administrative access or establishing control over a server. Hermes coordinated the broader campaign and provided instructions to the other tools.
The systems could investigate potential weaknesses, attempt different exploitation methods, and continue working toward an objective without constant human supervision. According to Gambit’s findings, successful compromises generally took less than a day, sometimes only a few hours.
This changes the economics of cybercrime.
An attacker who previously needed substantial time and expertise to pursue individual targets can now investigate many more organizations simultaneously. When an approach fails, an autonomous agent can explore alternatives without waiting for a human operator to review every result.
The $25 figure reflects the reported AI processing cost of completed scans, rather than the full expense of a successful compromise. Still, it illustrates how inexpensive automated attack operations can become. For online retailers, this raises a practical concern: security defenses and response processes designed around human attack speeds may struggle to keep pace.
How AI Agents Turn Website Compromises Into eSkimming Attacks
One of the most revealing aspects of Gambit’s research was how the attacker used compromised systems to deploy payment card skimmers. The initial access methods varied considerably. Agents exploited weaknesses involving web applications, credentials, administrative interfaces, cloud infrastructure, and server configurations.
Once an attacker gained sufficient access, however, the objective frequently became the same: introduce malicious JavaScript into the retailer’s website. Gambit documented several approaches.
Compromising Existing JavaScript Files
In one common technique, the attacker appended malicious code to legitimate JavaScript files already served by the website. Rather than introducing an entirely new script that might attract attention, the malicious loader became part of an existing library, including widely used components such as jQuery or Bootstrap.
The attacker also restored the file’s original timestamp, making the modification less obvious to anyone relying on basic file metadata. The legitimate application could continue functioning while the added code loaded a payment card skimmer.
Abusing Trusted Tag Management Infrastructure
Another attack inserted malicious JavaScript directly into an existing Google tag implementation. The injected code was placed among legitimate tracking instructions and padded with whitespace to make it harder to notice during a casual source-code inspection.
This technique exploited an established part of the website’s infrastructure rather than depending on the retailer to approve an unfamiliar integration.
Delivering Malicious Code Through First-Party Infrastructure
Gambit also documented a case in which compromised cloud credentials allowed an attacker to modify content served through a retailer’s own content delivery network (CDN). As a result, the malicious payload could be delivered through infrastructure associated with the legitimate website. Other techniques included modifying cached checkout pages and creating automated tasks that restored malicious code after legitimate files were redeployed.
These methods demonstrate an important characteristic of modern eSkimming: malicious code can arrive through infrastructure that the retailer already operates or trusts. The attacker may use AI to find the opening, but the browser ultimately executes the code that threatens the customer’s information.
Trusted JavaScript Creates a Dangerous Security Assumption
Modern eCommerce websites depend on JavaScript for essential functionality, including payment processing, analytics, personalization, advertising, and customer engagement. Much of this code originates from third-party vendors or relies on additional software libraries and services.
Security teams may evaluate where scripts originate, verify their integrity, and maintain lists of approved providers. The challenge appears when previously legitimate code is compromised or begins performing unauthorized actions. An approved script can become malicious without changing its apparent purpose or its relationship to the website.
Source Defense research has repeatedly documented this pattern.
In its 2025 eSkimming Landscape Report, Source Defense identified more than 92 distinct eSkimming campaigns affecting tens of thousands of eCommerce websites. The research revealed increasingly sophisticated attacks involving compromised first-party scripts, Google Tag Manager containers, dynamically loaded payloads, and techniques designed to evade conventional security controls. Google Tag Manager appeared in more than one-third of the documented attacks.
The Gambit campaign adds another dimension to these findings. AI-driven exploitation can accelerate the process of compromising trusted resources and introducing malicious functionality.
Content Security Policy (CSP) and Subresource Integrity (SRI) have limitations in these scenarios. CSP controls which resources browsers are permitted to load or execute, but its policies do not inherently determine whether an approved script is behaving maliciously. SRI verifies that a resource matches an expected cryptographic hash, but its effectiveness depends on how scripts are delivered, updated, and managed. Neither provides comprehensive control over the runtime behavior of authorized JavaScript.
For organizations operating dynamic eCommerce environments, the remaining security gap is the ability to prevent scripts from accessing or manipulating sensitive data without authorization.
AI-Driven Attacks Increase the Need for Runtime Protection
The speed of an autonomous attack raises an important question for security teams: What happens after an attacker successfully places malicious JavaScript on a website?
Traditional incident response depends on identifying suspicious activity, investigating the cause, and removing the malicious code. Those processes remain essential, but an attacker may be able to steal customer information during the time between deployment and remediation.
For eSkimming, the consequences can begin as soon as a customer enters information into a compromised payment form. Behavior-based client-side security provides an additional layer of protection by enforcing controls over what JavaScript can do while executing in the browser. Rather than depending exclusively on a script’s source or previously approved status, behavioral controls can restrict unauthorized access to sensitive information and prevent malicious interactions with the webpage.
Protecting Sensitive Data at the Point of Input
Source Defense Protect uses patented JavaScript sandboxing technology to monitor and control script behavior in real time. The platform enables organizations to establish policies governing how scripts interact with webpage elements, access sensitive form fields, and perform potentially harmful actions.
For example, properly configured protections can prevent unauthorized scripts from reading payment card information or capturing keystrokes entered into sensitive forms. Scripts can be isolated from protected webpage elements, have sensitive input redacted, or be blocked from interacting with the page.
This approach is particularly relevant when attackers compromise legitimate scripts or use trusted infrastructure to deliver malicious code. Even when an attacker succeeds in deploying a skimmer, runtime security policies can restrict the unauthorized browser behavior required to capture customer information.
This is important; Source Defense does not replace vulnerability management, credential security, application hardening, or other defenses intended to prevent the initial compromise. Its role is protecting the browser-side environment, including the point at which malicious scripts attempt to access and steal sensitive customer data.
As autonomous AI makes intrusion and malicious code deployment faster, preventing unauthorized behavior during the customer session becomes increasingly valuable.
What AI-Powered eSkimming Means for PCI DSS 4.0.1
The emergence of autonomous AI attacks also reinforces the security objectives behind PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1.
Requirement 6.4.3 addresses payment-page script management. Organizations must implement methods to confirm script authorization, assure script integrity, and maintain an inventory with written justification for each script’s necessity.
Requirement 11.6.1 addresses unauthorized changes to payment pages and security-impacting HTTP headers, including mechanisms for detecting changes and alerting personnel. The requirement specifies a monitoring frequency of at least once every seven days or a frequency established through the applicable targeted risk analysis.
These requirements address fundamental weaknesses in the JavaScript environments that power online payment experiences. However, the Gambit campaign illustrates how quickly attackers can progress from initial compromise to malicious code deployment. A compromise completed in hours can create significant exposure for organizations that rely exclusively on periodic inspections and manual intervention.
Meeting PCI DSS requirements remains essential for applicable organizations. Security leaders should also evaluate whether their defenses can limit the damage caused by malicious scripts between detection and remediation. Behavior-based controls can help by enforcing restrictions continuously during browser sessions, supporting both payment-page protection and the broader objective of preventing customer data theft.
Organizations should also evaluate risk across the complete customer payment journey, including pages and scripts outside the narrowly defined payment page where attackers may introduce malicious forms or manipulate checkout behavior.
Preparing for eSkimming at Machine Speed
Gambit’s findings demonstrate that financially motivated attackers can use readily available AI tools to conduct reconnaissance, exploit vulnerabilities, and deploy malicious code against multiple organizations with limited human oversight. The same campaign also exposed the risk of unintended operational damage. In one case, an automated cleanup process deleted database tables belonging to a compromised retailer, demonstrating that autonomous activity can create consequences beyond the attacker’s original objective.
Retailers should respond by strengthening defenses across the attack lifecycle.
That includes preventing initial access, securing administrative credentials and cloud infrastructure, managing application vulnerabilities, and improving their ability to recover from destructive activity. It also requires a closer examination of what happens inside the customer’s browser.
Once malicious JavaScript reaches a website, the immediate risk is determined by what that code is permitted to do. If it can access payment fields, capture keystrokes, or manipulate checkout forms, customer information may be exposed before security teams identify the compromise.
Attackers will continue developing faster and more automated methods for deploying malicious code. Organizations need security controls capable of enforcing appropriate restrictions at the point where sensitive data is entered.
Source Defense helps organizations protect customer data at the point of input through real-time, behavior-based controls over JavaScript execution.
As AI changes the speed and economics of eSkimming, protecting the browser against unauthorized script behavior is an increasingly important part of securing online commerce.
See What Your Website Scripts Can Access
Understand which scripts operate across your website, how they interact with sensitive customer information, and where unauthorized behavior could expose your business.
