Hackers Used Cairn AI Platform To Attack 100+ Firms

Hackers used Cairn to seek persistent access to websites and steal financial data from targets in several countries, according to an investigation by AI security firm Norforge.

Norforge found three clusters of activity after locating exposed Cairn control panels. The largest cluster contained more than 1,100 attack projects across 14 dashboards and used Chinese-language instructions. Its targets included e-commerce and payment infrastructure in the United States, Japan and Australia.

The operators sought access through webshells, tools that can give attackers remote control of compromised servers. Their process included automated checks to determine whether attacks had succeeded. Targets were ranked by website traffic and tested with Microsoft’s Playwright browser automation framework before being submitted to Cairn.

A second cluster exposed 10 panels and used English-language instructions. It focused on stealing credit card information and cryptocurrency from merchant payment services, gray-market payment websites and pharmaceutical platforms. Some targets were African commerce sites.

The third cluster exposed one panel with 59 projects. Its targets included a wide range of e-commerce websites, including large commercial platforms in the United States. The operators sought shell access, administrative-panel access and database access.

Norforge reported that the attackers succeeded in about 10% of their attempts. Data from the exposed panels contained hundreds of credentials and other secrets, with 11% confirmed to be valid.

Cairn is an open-source problem-solving engine that can coordinate multiple AI agents around a defined goal. Each task is organized as a project with a starting point and a destination. The agents perform tasks in sequence and record their plans and findings on a shared digital board.

The platform can support legitimate automated penetration testing. The exposed panels showed Cairn being used to automate attacks at scale. Norforge began its investigation after reviewing broader activity in which hackers used AI tools to target hundreds of online retailers.