开源工具
computerworld.com ·
AI 工具让黑客以每个目标 25 美元的成本实施入侵
据以色列安全公司 Gambit 研究，攻击者五天内在 105 家在线零售商中攻陷 27 家，平均每次攻击成本约 25 美元。其使用开源 AI 工具 Strix（漏洞搜索）、Cairn（端到端自动化利用）和 Hermes（攻击编排），并通过 OpenRouter 接入模型；仅两家企业即泄露 60 万条有效信用卡信息，另在五家植入盗刷脚本。多数入侵仅需数小时，成本极低。
AI推荐理由 Computerworld 引用以色列安全公司 Gambit 的研究，给出具体攻击规模（105 家零售商、27 家被攻陷）、成本（平均每次 25 美元）、所用开源 AI 工具（Strix、Cairn、Hermes）与模型接入方式（OpenRouter），并提及 60 万张信用卡数据泄露，事实与数字明确，对 AI 安全与 Agent 滥用风险有实际参考价值。
78
正文
It’s cheap to set yourself up as a hacker these days using AI. Someone attacked 105 online retailers over a period of five days, compromising 27 of them — all for an average of $25 per attack, according to research by Israeli security company Gambit.
But the attacks have been going on for much longer. Whoever is responsible used open-source AI harnesses to mount the attack. Gambit has identified three of these: Strix for vulnerability search, Cairn for autonomous end-to-end exploitation, and Hermes to orchestrate the campaign. The attacks have proved to be highly lucrative, with 600,000 active credit card details taken from just two businesses, the installation of card skimmer scripts at five more, and some level of access to an unspecified number of major companies.
It has been a highly efficient attack, most access taking just a few hours and at a minimal cost. OpenRouter was used for AI model access. The capture of the account balance on August 25 showed the attacker spent just $7,005 over a four-week period. This worked out at roughly $25 per attack, with costs ranging from $3.13 for the cheapest target to $79.31 for the most expensive.
Gambit has contacted all the companies concerned, but warned that the intensity of the attacks shows how AI is transforming cyber criminals’ activities by providing a level of sophistication that humans would find more challenging to muster. We are already seeing a new level of incursions to businesses and can expect to see more in the future.
This article first appeared on CSO.
Artificial IntelligenceCybercrimeSecurityRetail IndustryMarketsIndustry