Inside the Cairn AI Attack Campaign: How Automated Agents Compromised 100+ E-Commerce Sites
In October 2026, researchers at NorForge uncovered a large-scale, AI-assisted attack campaign leveraging the penetration-testing tool Cairn to autonomously compromise over 100 e-commerce and payment-infrastructure websites across the US, Australia, Canada, and Japan. Chinese-speaking threat actors orchestrated more than 1,100 attack projects across 14 exposed dashboards, directing AI agents to discover and exploit SQL injection, authentication bypasses, unsafe file uploads, and server-side template injection vulnerabilities—ultimately installing web shells for persistent access. Named victims include John Deere, SharkNinja, and Cummins, with financial theft and credential harvesting confirmed as primary objectives. This campaign signals a structural shift in attacker economics: AI coordination tools now allow adversaries to run hundreds of exploitation workflows in parallel for roughly five dollars per task, dramatically lowering the barrier to targeting organizations that were previously considered too costly to attack. Security teams operating on traditional reactive cycles are increasingly outpaced by these automated, multi-stage offensive pipelines.
Kill Chain
