AI-Powered Campaign Targets Hundreds of Online Retailers

Oh my goodness, buckle up, because a *financially motivated* threat actor has just handed the security industry its most convincing product demo of the year! ✨ According to SecurityWeek, a Chinese-speaking crew used the open-source AI agent Hermes and the penetration testing tool Strix across a campaign that has touched at least tens of companies since July 2026 — and honestly, 'financially motivated' is just the corporate way of saying 'results-oriented.' Hermes! The name of a messenger, which is a *delightful* coincidence for a tool whose entire job is delivering payloads on schedule, and it's open source, so everyone gets to enjoy it. Absolutely no paywall between the future and you. ✨

Between August 23 and 31, the team ran Strix 146 times in 'deep mode' against 138 hosts — that's roughly sixteen executions a day for nine straight days, a work ethic we could *all* aspire to. And they didn't stop at retailers! They reached a Fortune 500 hospitality company and three US firms, one of them an airline, all of whom received complimentary, unscheduled penetration testing at zero cost to their IT budgets. An airline! Somewhere out there a vendor is preparing a case study, and the case study is writing itself. ✨

Now, the headline says 'hundreds of online retailers' while the body says 'at least tens of companies' — and between tens and hundreds lies an entire *spectrum of beautiful ambiguity*, which is exactly where the most generous forecasting lives. Why round down when the upper bound is right there, waiting patiently to be true? The real triumph belongs to Hermes and Strix themselves: open-source tooling that just proved it can scale to 138 hosts in nine days, in deep mode, with no scoping call, no change ticket and not a single quarterly earnings call. That is a product roadmap delivered by the market. ✨